Yep, it's based on the package dependencies you list, looking for packages with know reported issues.