How to get a list of installed packages held back from upgrade?

You can use apt-mark:

apt-mark showhold

this will show the packages that are kept in "hold" state so that the pacakge manager won't auto upgrade the packages.

From man apt-mark:

showhold
           showhold is used to print a list of packages on hold

Use dpkg

dpkg -l | grep "^hi"

The -l means to list all packages which are then piped into grep.

The regular expression "^hi" means to search for all lines that begin with "hi" which are initials for "hold" and "installed".

By default, dpkg -l will list the status, package name, version, architecture, and a short description.