core: freeze dependency information

[doudou]

I've been wondering one time too many about whether the info had been modified in-place. Just freeze the bloody thing.

(For the record, always wondered, has not happened in a very long time)