manifest: don't track vendor add directly in dependencies