Comment 8 for bug 2033646

I think this is more a misunderstanding here, but the "workaround" is the right solution for this issue.

Specifically, unattended-upgrades is exactly designed to give you less preferable upgrades because the others are reserved for manual upgrades (i.e. -security vs -updates). That is, the security update should still be installed and not ignored because there is a higher version available in -updates for manual installing.

The same principle applies here: You configured a firefox PPA for manual upgrades, but there is an "intermediate" upgrade available that you did not configure.

Now of course this is a particularly odd case because the intermediate update would block the prefered update from being installed (due to the epoch), and while one could fix that particular corner case, it has problems:

- it's very hard to implement: not allowed origins are pinned to the minimum, we never see that they'd otherwise be the candidate.
- it's inconsistent with pinning for other intermediate packages that will get upgraded (i.e. a version 1 when you have version 2 pinned up)