bugfix: md5 calculation must be based on ordered transitive dependencies