This is, btw, why I think it's morally incumbent on corporate users of open source to have a way to build patched versions of the software internally, well before they need it. You have the resources to do so, and your timeline is not the maintainer's timeline. At some point you will need to apply a patch to one of your dependencies. Do not engineer yourself into a place where the the thing that delivers the most business value is to bully the maintainer.