fix: always use package key when reading from dependency list instead of package name

fix: always use package key when reading from dependency list instead of package name #2913