docs: document why abandoned azure-storage-blob is kept#153
Conversation
phpbu's Azure Blob sync adapter (Backup\Sync\AzureBlob) is hardwired to the MicrosoftAzure\Storage\Blob\BlobRestProxy client from microsoft/azure-storage-blob, which Microsoft has abandoned with no Composer replacement. The package is kept intentionally so the full image retains Azure sync; its only moving security surface (Guzzle) is patched via Dependabot. Adds a tracking note to the README sync-targets table and a comment at the Dockerfile install site so the recurring composer/bot abandonment advisory reads as a known, accepted decision. Upstream migration to the maintained azure-oss/storage SDK has to land in phpbu first. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds documentation in both the Dockerfile and README.md explaining why the abandoned microsoft/azure-storage-blob package is intentionally retained in the "full" image. The feedback suggests improving the README by adding an active hyperlink to the upstream issue tracker instead of using plain text for "tracked there".
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| > surface (Guzzle) is patched via Dependabot. A migration to the maintained `azure-oss/storage` | ||
| > SDK has to happen in phpbu upstream first; tracked there. If you don't sync to Azure, use the | ||
| > `minimal` image, which doesn't carry this dependency. |
There was a problem hiding this comment.
The phrase "tracked there" is plain text and lacks a hyperlink. Since the upstream issue is being drafted, it would be highly beneficial to turn this into an active hyperlink to the phpbu issues page (or the specific issue once created) so users can easily navigate to and track the progress.
For example:
> surface (Guzzle) is patched via Dependabot. A migration to the maintained `azure-oss/storage`
> SDK has to happen in phpbu upstream first; [tracked upstream](https://github.com/sebastianfeldmann/phpbu/issues). If you don't sync to Azure, use the
> `minimal` image, which doesn't carry this dependency.
|
Superseded by #154 — phpbu 6.0.32 migrated its Azure adapter to the maintained |
|
#154) Removes the abandoned `microsoft/azure-storage-blob` SDK from the **full** image by adopting phpbu 6.0.32's migration to the maintained `azure-oss/storage`. ## Background `microsoft/azure-storage-blob` is abandoned upstream (Microsoft archived it; Packagist `abandoned: true`, no replacement). It was a direct require in the full image only because phpbu's Azure Blob sync adapter was hardwired to it. That's now fixed at the root: phpbu migrated the adapter to `azure-oss/storage` in [sebastianfeldmann/phpbu#402](sebastianfeldmann/phpbu#402), released in [phpbu 6.0.32](https://github.com/sebastianfeldmann/phpbu/releases/tag/6.0.32). ## What changed (`app/full/composer.json` + lock) - `phpbu/phpbu` `^6.0` → `^6.0.32` (the release whose Azure adapter uses azure-oss). - Direct require `microsoft/azure-storage-blob: ^1.4` → `azure-oss/storage: ^1.9` (phpbu lists azure-oss as `suggest`/`require-dev`, so the full image still declares it explicitly to enable the adapter). - `composer update` removed `microsoft/azure-storage-blob` + `microsoft/azure-storage-common` entirely; pulled `azure-oss/storage` 1.9.0, `azure-oss/storage-common`, `azure-oss/identity`. ## Verification - `composer validate` clean; **no abandoned packages remain in the lock**; `composer audit` reports no advisories. - phpbu 6.0.32's `azureblob` sync runs in `--simulate` under PHP 8.5: loads `AzureOss\Storage\Blob\BlobServiceClient` (no "SDK not loaded") and masks the credential (`connectionString: ********`). - The Security Scan (Trivy) runs on this PR and rebuilds the full image — it should now be clean of the abandonment finding. ## Supersedes This replaces the documentation-only workaround in #153 (which explained why the abandoned package was kept). With the package removed, that note is obsolete — closing #153 in favour of this fix.
1 participant
Follow-up to #152. Documents the
microsoft/azure-storage-blobabandonment surfaced by Gemini Code Assist there, so it reads as a known/accepted decision rather than recurring as review noise.Context
microsoft/azure-storage-blobis a direct require inapp/full/composer.json— nothing transitive pulls it. It's there so phpbu's Azure Blob sync adapter works.Backup\Sync\AzureBlobis hardwired toMicrosoftAzure\Storage\Blob\BlobRestProxy::createBlobService()— there's no abstraction to swap the client.microsoft/azure-storage-*family (abandoned: true, no Composer replacement). The maintained community successor isazure-oss/storage, but it's a different namespace — not drop-in, so the migration has to happen in phpbu upstream first.What this PR does
Documentation only — no dependency or behavior change:
minimalimage.composer installsite so the abandonment warning in the build log reads as intentional.Not done here (by design)
.trivyignore— Trivy scans CVEs, not abandonment; it never flagged this.composer auditsuppression — CI doesn't runcomposer audit.An upstream phpbu issue proposing the
azure-oss/storagemigration is being drafted; its link will be added here once filed.