third party dependency analysis