vendorize dependencies