vendor dependencies should link to node_modules, so they work in development and production