How to update Modsecurity version

We have UTM version 9.605-1 on our webservers at our hosting company.  I see in the WAF logs it appears we're using CRS 2.2.7  (it says OWASP_CRS/2.2.7 against security2 errors)

I've asked our hosting company if they can update to a later version of CRS but they suggested theres nothing they can do, it just comes with the new versions of UTM.  Is that true? 

I was expecting we should be on at least version 2.9.1  given this post