From dcefb90a5440f56d9da088b000534b50db918608 Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Sat, 20 Jun 2026 16:00:34 +0200 Subject: [PATCH] docs: document why abandoned azure-storage-blob is kept phpbu's Azure Blob sync adapter (Backup\Sync\AzureBlob) is hardwired to the MicrosoftAzure\Storage\Blob\BlobRestProxy client from microsoft/azure-storage-blob, which Microsoft has abandoned with no Composer replacement. The package is kept intentionally so the full image retains Azure sync; its only moving security surface (Guzzle) is patched via Dependabot. Adds a tracking note to the README sync-targets table and a comment at the Dockerfile install site so the recurring composer/bot abandonment advisory reads as a known, accepted decision. Upstream migration to the maintained azure-oss/storage SDK has to land in phpbu first. Signed-off-by: Sebastian Mendel --- Dockerfile | 5 ++++- README.md | 12 +++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index d8359ba..55ca5a8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -83,7 +83,10 @@ COPY --from=composer:2@sha256:1c62c57bb5228569034b7b4d1415b17ba6b731619f7de226ea COPY --chown=phpbu:phpbu app/full/composer.json ./composer.json COPY --chown=phpbu:phpbu app/full/composer.lock ./composer.lock -# Install dependencies with optimization +# Install dependencies with optimization. +# NOTE: composer warns that microsoft/azure-storage-blob is abandoned. This is +# intentional and accepted — phpbu's Azure Blob sync adapter is hardwired to that +# SDK and Microsoft shipped no replacement. See README "Supported Sync Targets". RUN composer install \ --no-ansi \ --no-dev \ diff --git a/README.md b/README.md index c9e811e..e04eb40 100644 --- a/README.md +++ b/README.md @@ -240,13 +240,23 @@ services: |--------|-------------|---------| | Amazon S3 / S3-compatible | `aws/aws-sdk-php` | **full** | | Google Cloud Storage | `google/cloud-storage` | **full** | -| Azure Blob Storage | `microsoft/azure-storage-blob` | **full** | +| Azure Blob Storage | `microsoft/azure-storage-blob` ⚠️ | **full** | | SFTP | `phpseclib/phpseclib` | **full** | | FTP | `sebastianfeldmann/ftp` | **full** | | Dropbox | `kunalvarma05/dropbox-php-sdk` | **full** | | Rsync | system binary | **full** | | Local/NFS | - | minimal, full | +> ⚠️ **`microsoft/azure-storage-blob` is abandoned upstream.** Microsoft retired the +> `microsoft/azure-storage-*` libraries with no Composer replacement. We keep the package +> intentionally because phpbu's Azure Blob sync adapter +> ([`Backup\Sync\AzureBlob`](https://github.com/sebastianfeldmann/phpbu/blob/master/src/Backup/Sync/AzureBlob.php)) +> is hardwired to its `MicrosoftAzure\Storage\Blob\BlobRestProxy` client — dropping it would +> remove Azure sync from the full image. The package still works and its only moving security +> surface (Guzzle) is patched via Dependabot. A migration to the maintained `azure-oss/storage` +> SDK has to happen in phpbu upstream first; tracked there. If you don't sync to Azure, use the +> `minimal` image, which doesn't carry this dependency. + ### Additional Tools (full variant only) | Tool | Purpose |