Do outdated Javascript libraries present a risk for my web application?

Using any out of date software is inherently a security risk; any flaws patched between the version you're running and the latest version can be exploited. For example, maybe there's a specific payload you can feed it to cause an infinite loop, potentially causing a Denial of Service (DOS) event, or maybe there's a bug that can somehow break the JavaScript sandbox and wreak havoc on the system.

I don't see any critical security issues mentioned on the Internet, but that doesn't mean that they don't exist or haven't been patched. Using the latest version is always recommended when possible, but this may also include testing your code with the new version to make sure that it doesn't break functionality-wise when you update (for example, major releases are often incompatible with prior major releases).

The best way to keep your libraries up to date is to use the package from a toolchain that provides one-click upgrades. For example, if you copy the library to your local server using npm install, you can then import them directly (cloudflare will will provide protection for your site if you use them). From there, updating your libraries is as easy as npm update from the command-line terminal.

It's strongly recommended that you use a TDD (Test Driven Development) suite, such as Mocha, to make sure that your scripts do not break when libraries are upgraded, as well as generally reducing the chance you'll break your code during development. Also, remember to use a repository (like git or subversion) so that you can roll back changes if the npm update causes stuff to break.

That depends on the (known) vulnerabilities in the outdates JavaScript library. Often newer versions fix (minor) security issues as well.

A great list to check your library against, is a tool called Retire.js.

Also note that the use of a content delivery network (CDN) like CloudFlare might be a minor risk itself. Because theoretically they can change the contents of the JavaScript that is included on your page. To mitigate this type of risk I would recommend to check out Sub resource integrity (SRI).