npm update adds "dev:true" in package-lock.json

Question

I'm auditing the packages in my project. I want to address vulnerability for each package separately rather than running npm audit fix. Most of the vulnerabilities are in the dependencies and not in the main package which is installed. For example I have installed package foo, it added dependencies for it in the package-lock.json ie bar:1.1.0 etc. Now the vulnerability is for bar which is fixed in patch version:1.1.1. so to fix it I'm updating the package using npm update bar.

On running the update command the package-lock.json is flooded with version updates for packages some of which are not relevant to bar and changes more than 200 lines in the lock file. Also, the npm update or npm audit fix command adds "dev": true in almost all the package definition which was not present earlier.

Question

Is there any way that npm update not adds the "dev": true in unwanted places or how can I update a single package at a time which will keep my commits clean and easy to track.

I have tried the command npm update foo --omit=dev, but it did not worked.