ModuleDependency has 4 constructors, with the one that ultimately gets called taking 4 different boolean parameters. Stuff like this is a bug waiting to happen and is a pain to review:

moduleSpecification.addSystemDependency(new ModuleDependency(moduleLoader, moduleName, false, false, false, false));

Note: Since this will be a new API, the builder shouldn't use the deprecated ModuleIdentifier class. Use a String.

Note: Use a different issue for any general cleanup work re the use of ModuleIdentifier in the ModuleDependency class.