All vendor files must come from package manager