And any time a dependency breaks, there's a chance that the external fix will not come timely, or that whatever fix is right for you will not be compatible with that dependency's overall goal, so you'll end up maintaining an internal fork anyway.

I don't think there's a way around it. Professionals don't shy away from taking responsibility for all the code that goes into their product.