Ignoring security vulnerabilities tends to not work out so well. And sure, you can submit a PR. It might not get merged. Sure, you can just fork it. At that point you might as well use htmx.