Ignore vendors
Lock down dependencies