BUG: fix `dependencies` not `pkginfo`

We want to order the `dependencies` deterministically, not the package.