adds vendor dependencies via npm update