Most of your app is code you did not write, including libraries pulled in by your libraries. A known vulnerability in any of them is a vulnerability in your app. Dependency scanning checks your lockfile against CVE databases on every PR and on a schedule, and can fail the build on critical issues. It does not review your own code for bugs, which is what SAST tools are for.