Cached proxy repository artifacts will become permanently quarantined if a cache is expired on a proxy in Nexus Repo 2.x

The detailed reproduce steps for this can be found on issue  NEXUS-18352. 

 But in a nutshell...

If you expire cache on a proxy repository in Nexus Repo 2 Nexus will send a HEAD request to the remote to check for updates to cached components as new requests for them are made to the proxy repository .  It will not download the jar unless it has changed.  But unfortunately, the  storageItem-storedLocally attribute updated anyhow.  And as shown in NEXUS-18352, if firewall quarantine is enabled this will cause components to go permanently in PENDING evaluation state.

Note that this HEAD request is made even if both artifact and item max age to "-1".  So there is no way to stop this, any time someone expires caches on a firewall enabled proxy repository in Nexus Repo 2 there is the possibility of components becoming permanently stuck in PENDING state, and this will block their download.