Ok to modify bundled Bootstrap source?

Hi guys

I need your help with a legal/licenese question, I guess.

Trying to tackle the Bootstrap Popover issue 
(https://issues.apache.org/jira/browse/TAP5-2686), I got as far as 
understanding the cause of the problem.

In a nutshell, there is bug in Bootstrap's popover.js that prevents 
popovers from working with Bootstrap 4.3.1 (the release currently 
bundled with Tapestry). The bug was fixed in Bootstrap 4.6.0. See my 
comment in Jira for details.

My question is, can we just modify the popover.js in Bootstrap 4.3.1 to 
fix the bug? It's a trivial change (remove 3 characters), but it's still 
a change. Our source code is open to the public, so I guess we can?

As an alternative, we should upgrade the bundled Bootstrap to 4.+ to 
make popovers work and resolve the issue.

Keen to hear about your thoughts.

Thank you and have a nice weekend everyone.

Volker