vendorize external dependencies