The following code is flagged as dead (since it's *replacing* rather than updating the existing Object):
https://github.com/mozilla/pdf.js/blob/4483cba72410027acf46630ebf252ae529704476/src/core/xfa/template.js#L2336-L2339
according to the alert in https://github.com/mozilla/pdf.js/security/code-scanning/103?query=ref%3Arefs%2Fheads%2Fmaster

Looking at the surrounding code, I can see a couple of possibilities here:
 1. This is indeed just dead code, which should be removed.
 2. The code should be moved up, and placed just *above* the previous block instead.
 3. There should be other, more invasive, changes made to this code...

/cc @calixteman Which solution is correct here?
Assuming it's either option 1 or 2, I can submit a patch to fix this.
$popPara,
  $pushPara,
  $removeChild,
  $searchNode,
  $setSetAttributes,
  $setValue,
  $tabIndex,
  $text,
  $toHTML,
  $toStyle,
  $uid,
  ContentObject,
  Option01,
  OptionObject,
  StringObject,
  XFAObject,
  XFAObjectArray,
} from "./xfa_object.js";
import { $buildXFAObject, NamespaceIds } from "./namespaces.js";
import {
  addHTML,
  checkDimensions,
  flushHTML,
  getAvailableSpace,
} from "./layout.js";
import {
  computeBbox,
  createWrapper,
  fixDimensions,
  fixTextIndent,