The responsible thing to do would be to report the bug to the upstream project and keep the issue open pending the underlying issue's resolution.
This is a broader cultural thing. In large organizations there is a tendency toward deflecting as much responsibility as possible onto other teams. In part it's a lack of resources, but it's also a result of individual contributors not being willing to take ownership of the product they work on.
You can fix it by handling the erroneous output from your dependency, or switching out your dependency, or submit a fix to the dependency, or asking them to fix it.
This is a broader cultural thing. In large organizations there is a tendency toward deflecting as much responsibility as possible onto other teams. In part it's a lack of resources, but it's also a result of individual contributors not being willing to take ownership of the product they work on.