Right now, we omit dependencies, which is optional. But it seems useful to include, for auditing purposes. The spec does not define the format, so we can write whatever we want in that field.