We run `cargo update` during the build which updates Cargo.lock with what is available in the vendor dir.