extract dependencies from user attributes