I just updated Zotero from the AUR and, during the build process, the pdf.js dependency reported 25 vulnerabilities, of which 5 being critical. Given that we s

I just updated Zotero from the AUR and, during the build process, the pdf.js dependency reported 25 vulnerabilities, of which 5 being critical. Given that we sometimes pull pdf from questionable sources/websites, should that not be a priority to fix? Or is there a standard mitigation process that I am not aware of?