In some cases an MCR image (and maybe Docker Hub too?) can be flagged as out-of-date when it is not. For example, what I have here:

MCR returns the latest digest as being sha256:eda85a60aeb00e7904347d321095d8115f171dacc5d84feba4644ca4905c0204. When I inspect the image locally, it has the following for RepoDigests:
"RepoDigests": [
"mcr.microsoft.com/dotnet/sdk@sha256:c0dc643e15be6d5aad6f51a4cc5dc8966bbecdc83647e58276fdc0b155361eaf",
"mcr.microsoft.com/dotnet/sdk@sha256:eda85a60aeb00e7904347d321095d8115f171dacc5d84feba4644ca4905c0204"
],
This line considers only the first repo digest and is the source of the bug.
When I remove and re-pull the image, it no longer has the first digest and is not flagged, so I'm not totally sure how this works.