In our SCA , Veracode is scanning dev dependencies as well. We are uploading package.json and package-lock.json as per the requirement by Veracode. Below is example from package json for which dev:true but still this file is showing in SCA vulnerability. Is this correct behaviour?

 "node_modules/@microsoft/rush-lib": {

   "version": "5.135.0-pr4927.1",

   "resolved": "https://registry.npmjs.org/@microsoft/rush-lib/-/rush-lib-5.135.0-pr4927.1.tgz",

   "integrity": "sha512-9HbxSdTGxEeLaZB3srs4iH4wH5zXIWOmOPTX9xXm70/Ue2futK4Iar7WUVE21bgBYLCf6+v51ILaCddvE7fr3w==",

   "dev": true,

   "license": "MIT",

   "dependencies": {

    "@pnpm/dependency-path": "~2.1.2",

    "@pnpm/link-bins": "~5.3.7",

    "@rushstack/heft-config-file": "0.15.7",

    "@rushstack/lookup-by-path": "0.2.2",

    "@rushstack/node-core-library": "5.9.0",

    "@rushstack/package-deps-hash": "4.2.0",

    "@rushstack/package-extractor": "0.9.1",

    "@rushstack/rig-package": "0.5.3",

    "@rushstack/rush-amazon-s3-build-cache-plugin": "5.135.0-pr4927.1",

    "@rushstack/rush-azure-storage-build-cache-plugin": "5.135.0-pr4927.1",

    "@rushstack/rush-http-build-cache-plugin": "5.135.0-pr4927.1",

    "@rushstack/stream-collator": "4.1.67",

    "@rushstack/terminal": "0.14.2",

    "@rushstack/ts-command-line": "4.22.8",

    "@types/node-fetch": "2.6.2",

    "@yarnpkg/lockfile": "~1.0.2",

    "builtin-modules": "~3.1.0",

    "cli-table": "~0.3.1",

    "dependency-path": "~9.2.8",

    "fast-glob": "~3.3.1",

    "figures": "3.0.0",

    "git-repo-info": "~2.1.0",

    "glob-escape": "~0.0.2",

    "https-proxy-agent": "~5.0.0",

    "ignore": "~5.1.6",

    "inquirer": "~7.3.3",

    "js-yaml": "~3.13.1",

    "node-fetch": "2.6.7",

    "npm-check": "~6.0.1",

    "npm-package-arg": "~6.1.0",

    "pnpm-sync-lib": "0.2.9",

    "read-package-tree": "~5.1.5",

    "rxjs": "~6.6.7",

    "semver": "~7.5.4",

    "ssri": "~8.0.0",

    "strict-uri-encode": "~2.0.0",

    "tapable": "2.2.1",

    "tar": "~6.2.1",

    "true-case-path": "~2.2.1",

    "uuid": "~8.3.2"

   },

I am seeing medium issue for tar. By right it should be excluded from scan.