update vendored packages