How do updates for pinned versions work?

[wsw70]

This is an example of some possible updates for my docker containers:

This covers the three cases I deal with:

• domotique-esphome-1: I use the latest tag in my docker compose, so whatever comes is great → WUD suggets a new container → great! 🆗 (but why is it orange?)
• domotique-esphome-1: I use the major version in my docker compose (in that case :2025.12). I want to update minor versions (e.g. 2025.12.1), but not above the pinned one. WUD suggests the latest 2026 dev, which I do not want 🫤
  How to set up WUD so that it upgrades versions below the pinned one, but not above?
• domotique-mqtt-1: I pinned the :2 tag, WID correctly suggests to move to 2.0.22 🆗

So it looks like :latest is covered, but only some pinned tags. How to address that?

EDIT: another, even weirder case of a "red" update

Here the default Traefik :3 image (based of some Linux, probably Alpine) would be updated to another architecture (just because it is the latest one changed)