#823664 debsecan: confused if a newer version as in $codename-security is accepted via $codename-updates