third-party dependencies