vendor folder must play well with npm modules

[ceremcem]

We should avoid "copy-and-paste"ing of 3rd party libraries into ./vendor folder in order to prevent following difficulties:

• copy-and-paste makes it way harder to create a PR for a 3rd party when we made an improvement
• copy-and-paste makes it harder to apply any updates