I think we only count the _added_ dependencies. We should subtract any removed dependencies too before comparing to the threshold