How are compile dependencies handled in dependency management?

I'm not sure if I found a bug or if the behavior of the ODC is correct.

I have a Maven parent project that defines JUnit Jupiter Vintage 5.7.2 in Dependency Management. I've set the skipDependencyManagement flag and skipTestScope to false and I also see that the JUnit libs are being scanned. A CVE is not found.

```xml



org.junit.vintage
junit-vintage-engine
5.7.2
test



```
Result in Sonar:

But if I now use this parent in a pom and use the JUnit Jupiter Library explicitly, it tells me that there is a CVE-2020-15250 in JUnit 4.13 which is used by the Jupiter 5.7.2 as a compile dependency.

```xml

org.junit.vintage
junit-vintage-engine
test


```

https://search.maven.org/artifact/org.junit.vintage/junit-vintage-engine/5.7.2/jar


So I can understand why he reported this to me. What I don't understand is why this is not recognized in my parent, although the Jupiter 5.7.2 was also scanned.

Or are compile dependencies only evaluated once they are actually used?
Or to put it another way: Why doesn't it recognize the CVE if the Jupiter Lib is "only" in Dependency Management?