vendoring dependencies