the dependency is open source ya?

if upgrading is that bad can always (usually) patch it yourself