vendor dependencies