BUG: Nexus 3.93.1 and PEP 691 JSON

Sonatype Nexus Repository
1

This morning we ran into the following issue:

  1. If I use pip version 22, then when querying Nexus the latest version of the click package is 8.4.1:
pip3 --version
pip 22.0.2 from /usr/lib/python3/dist-packages/pip (python 3.10)

pip index versions click
WARNING: pip index is currently an experimental command. It may be removed/changed **`in`**` a future release without prior warning.
click 8.4.1
Available versions: 8.4.1, 8.4.0, 8.3.3, 8.3.2, 8.3.1, 8.3.0, 8.2.1, 8.2.0, 8.1.8, 8.1.7, 8.1.6, 8.1.5, 8.1.4, 8.1.3, 8.1.2, 8.1.1, 8.1.0, 8.0.4, 8.0.3, 8.0.2, 8.0.1, 8.0.0, 7.1.2, 7.1.1, 7.1, 7.0, 6.7, 6.6, 6.5, 6.4, 6.3, 6.2, 6.1, 6.0, 5.1, 5.0, 4.1, 4.0, 3.3, 3.2, 3.1, 3.0, 2.6, 2.5, 2.4, 2.3, 2.2, 2.1, 2.0, 1.1, 1.0, 0.7, 0.6, 0.5.1, 0.5, 0.4, 0.3, 0.2, 0.1

On the proxy repository I have metadata_max_age = 1440.

  1. If I upgrade pip to the latest version, the index already shows the new 8.4.2 release:
pip3 install --upgrade pip
Successfully installed pip-26.1.2

pip index versions click
click (8.4.2)
Available versions: 8.4.2, 8.4.1, 8.4.0, 8.3.3, 8.3.2, 8.3.1, 8.3.0, 8.2.1, 8.2.0, 8.1.8, 8.1.7, 8.1.6, 8.1.5, 8.1.4, 8.1.3, 8.1.2, 8.1.1, 8.1.0, 8.0.4, 8.0.3, 8.0.2, 8.0.1, 8.0.0, 7.1.2, 7.1.1, 7.1, 7.0, 6.7, 6.6, 6.5, 6.4, 6.3, 6.2, 6.1, 6.0, 5.1, 5.0, 4.1, 4.0, 3.3, 3.2, 3.1, 3.0, 2.6, 2.5, 2.4, 2.3, 2.2, 2.1, 2.0, 1.1, 1.0, 0.7, 0.6, 0.5.1, 0.5, 0.4, 0.3, 0.2, 0.1

As a result, our pipelines break, because the new version is already visible in the index, but the package with this new version has not yet been downloaded/cached on Nexus itself.

My question is: how does the JSON index already know about the new metadata? Does metadata_max_age = 1440 not apply to it?