vendor dependencies in vendored/