You have firefox-esr pinned to the stable repository with a very high priority:

 *** 52.9.0esr-1~deb9u1 30000

That prevents any release from any other repository with a lower pin priority from being installed, including the security update which only has priority 500:

     60.2.0esr-1~deb9u2 500

The pin comes from apt-listbugs: it decided (or was told — I think it always asks, but there may be some configurations where it doesn’t) that the upgrade to Firefox 60 should be put on hold until bugs 908396 and 908449 are fixed. Those bugs are related to the new requirement for SSE2 instructions on i386; since you’re running amd64, they don’t concern you, and it should be safe for you to upgrade.

You need to remove the pin priority for the upgrade to proceed. Delete /etc/apt/preferences.d/apt-listbugs, and if apt-listbugs asks you again, tell it that you do want to upgrade.

You have firefox-esr pinned to the currently-installed version with a very high priority:

 *** 52.9.0esr-1~deb9u1 30000

That prevents any other version with a lower pin priority from being installed, including the security update which only has priority 500:

     60.2.0esr-1~deb9u2 500

The pin comes from apt-listbugs: it decided (or was told — I think it always asks, but there may be some configurations where it doesn’t) that the upgrade to Firefox 60 should be put on hold until bugs 908396 and 908449 are fixed. Those bugs are related to the new requirement for SSE2 instructions on i386; since you’re running amd64, they don’t concern you, and it should be safe for you to upgrade.

You need to remove the pin priority for the upgrade to proceed. Delete /etc/apt/preferences.d/apt-listbugs, and if apt-listbugs asks you again, tell it that you do want to upgrade.

For some reason, you have firefox-esr pinned to the stable repository with a very high priority:

 *** 52.9.0esr-1~deb9u1 30000

That prevents any release from any other repository with a lower pin priority from being installed, including the security update which only has priority 500:

     60.2.0esr-1~deb9u2 500

You need to remove the pin priority for the upgrade to proceed. Look at /etc/apt/preferences and any files in /etc/apt/preferences.d.

You have firefox-esr pinned to the stable repository with a very high priority:

 *** 52.9.0esr-1~deb9u1 30000

That prevents any release from any other repository with a lower pin priority from being installed, including the security update which only has priority 500:

     60.2.0esr-1~deb9u2 500

The pin comes from apt-listbugs: it decided (or was told — I think it always asks, but there may be some configurations where it doesn’t) that the upgrade to Firefox 60 should be put on hold until bugs 908396 and 908449 are fixed. Those bugs are related to the new requirement for SSE2 instructions on i386; since you’re running amd64, they don’t concern you, and it should be safe for you to upgrade.

You need to remove the pin priority for the upgrade to proceed. Delete /etc/apt/preferences.d/apt-listbugs, and if apt-listbugs asks you again, tell it that you do want to upgrade.