The detailed reproduce steps for this can be found on issue
But in a nutshell...
If you expire cache on a proxy repository in Nexus Repo 2 Nexus will send a HEAD request to the remote to check for updates to cached components as new requests for them are made to the proxy repository . It will not download the jar unless it has changed. But unfortunately, the storageItem-storedLocally attribute updated anyhow. And as shown in
, if firewall quarantine is enabled this will cause components to go permanently in PENDING evaluation state. NEXUS-18352
Note that this HEAD request is made even if both artifact and item max age to "-1". So there is no way to stop this, any time someone expires caches on a firewall enabled proxy repository in Nexus Repo 2 there is the possibility of components becoming permanently stuck in PENDING state, and this will block their download.