When Drupal complains for a security update, then the warning is correct, because there is a new Drupal core version out there, which is not yet rolled out via Debian update mechanism. So the warning is OK, but the comment could be different: no manual action is needed by the user, the Drupal core will be updated via Debian.
Doka
