vendoring deps