Any changes to the vendored library really need to be done as separate commits and should only be ports of patches already applied to the library itself. I think the commit should also clearly call out where the patch came from (reference the commit to the other repo would be best).