manifest: track our vendor package