Why is Nexus advertising a version, which it wouldn't download? - maven-3

Question

A dependency of one of our projects cut a new release four weeks ago -- 1.8.0.
The Nexus metadata duly lists this version as available:
<metadata modelVersion="1.1.0">
<groupId>com.splunk.logging</groupId>
<artifactId>splunk-library-javalogging</artifactId>
<version>1.7.3</version>
<versioning>
<latest>1.8.0</latest>
<release>1.8.0</release>
<versions>
<version>1.0.1</version>
<version>1.5.0</version>
<version>1.5.1</version>
<version>1.5.2</version>
<version>1.5.3</version>
<version>1.5.4</version>
<version>1.6.0</version>
<version>1.6.1</version>
<version>1.6.2</version>
<version>1.7.0</version>
<version>1.7.1</version>
<version>1.7.2</version>
<version>1.7.3</version>
<version>1.8.0</version>
</versions>
<lastUpdated>20200117004445</lastUpdated>
</versioning>
</metadata>
In the project's pom.xml file, the dependency's version is set as <version>[1.7.2,)</version> and so Maven is trying to download the newly-available 1.8.0. And fails, because our Nexus does not have it for some reason.
Our private Nexus is simply proxying nexus.pentaho.org -- which has the same (at the time of this typing) metadata file as I copy-pasted above, but not the actual splunk-library-javalogging-1.8.0.jar -- though earlier versions are available.
Is that, perhaps, because the <version> in the above metadata is still set to 1.7.3 -- even though both the <latest> and the <release> are set to 1.8.0?
Why would that be, and how should I deal with it -- without explicitly excluding 1.8.0?

Answer 1

The problem is on the remote web site... the maven-metadata.xml file from that site is showing 1.8.0, but that version isn't available:
https://nexus.pentaho.org/repository/proxy-public-3rd-party-release/com/splunk/logging/splunk-library-javalogging/1.8.0/splunk-library-javalogging-1.8.0.pom
Note that version 1.7.3 is available:
https://nexus.pentaho.org/repository/proxy-public-3rd-party-release/com/splunk/logging/splunk-library-javalogging/1.7.3/splunk-library-javalogging-1.7.3.pom
You'll need to either get the maintainers of that site to fix this, or lock down your version to 1.7.3.