zypper dup now defaults to --no-allow-vendor-change (on Tumbleweed only), making any wrapper around it no longer necessary.