Let say in composer.json you have
You're attempting to run
composer update "drupal/core-*" --with-all-dependencies
...to update to the latest 9.2.x version. Yet instead you are finding 9.3.6 installed.
How do you use caret version constraint for core-recommended? Caret means "any compatible version" which as of today is version 9.3. However, if you want to stay on 9.2 you use a 9.2.* version constraint.
Minor updates only introduce backwards-compatible new features.