That would be my second suggestion ("check that all of its immediate dependencies are also listed in pkgDeps"), but my point is that deps_test.go should have caught this. It's also missing at least image/internal/imageutil, mime/quotedprintable, internal/singleflight, internal/mime, container/list, internal/syscall/unix, and internal/syscall/windows, so it's blind to transitive dependencies added via those packages too.
the dep test is designed before the internal package thing, a time
when adding packages to std packages is way harder.
I think the problem is that when a new internal package is introduced,
its dependency must be locked down in deps_test.go, but that was
deps test just need to caught any package not explicitly locked down.