1. Fork every dependency in the chain. Which typically isn't more than two or three dependencies.

2. Fork the distant dependency, and specify it as a direct dependency.

3. Fork the distant dependency, and only update your lock file.

Option 1 is probably the "correct" approach, and sometimes necessary anyway, if you've made contract/API changes to a dependency of a dependency. It will also make it easier to contribute your changes upstream - which presumably you're wanting to do to avoid the maintenance burden of maintaining forks.

Option 2 is the "easiest", but probably least correct as you're adding a hard dependency where one shouldn't exist.

Option 3 works fine until you try regenerate your lock file.

Quickfix doesn't seem to take itself too seriously, which is nice, but I'd happily argue that any one of the 3 approaches given above is better than the approach Quickfix is taking.