The UpdateOSLibs dagger command sometimes removes a dependency from the list of library, like in 7eed986.
This doesn't happen because that package is not a dependency of the extension anymore, but because that package has been released without a valid MD5sum, and our regexp discard the line entirely if that field is not present.
That is very counter intuitive, so I propose making the MD5Sum part optional, capturing only the name of the .deb package if the MD5Sum is missing.