Merge "neverallow fwk access to /vendor"