VSTest Drops Newtonsoft.Json: Critical Security Update in .NET 11 Preview 4

<h2>Breaking: VSTest Removes Newtonsoft.Json Dependency Starting .NET 11 Preview 4</h2> <p><strong>In a significant security-driven move, Microsoft announced today that VSTest (the test platform powering <code>dotnet test</code> and Test Explorer) will no longer depend on Newtonsoft.Json beginning with .NET 11 Preview 4 and Visual Studio 18.8.</strong> The platform is migrating to <strong>System.Text.Json</strong> on .NET and <strong>JSONite</strong> on .NET Framework.</p><figure style="margin:20px 0"><img src="https://devblogs.microsoft.com/dotnet/wp-content/uploads/sites/10/2026/04/vs-test-is-removing-its-newtonsoft-json-dependency.webp" alt="VSTest Drops Newtonsoft.Json: Critical Security Update in .NET 11 Preview 4" style="width:100%;height:auto;border-radius:8px" loading="lazy"><figcaption style="font-size:12px;color:#666;margin-top:5px">Source: devblogs.microsoft.com</figcaption></figure> <p>This change is classified as a servicing and security update. While most test projects will require no action, a small subset may experience build or runtime failures that can be resolved with a single-line package reference.</p> <h3>Why the Urgent Change?</h3> <p>All versions of Newtonsoft.Json below 13.0.0 are now marked as vulnerable on NuGet.org. VSTest had shipped Newtonsoft.Json as part of the .NET SDK and Visual Studio for years. Carrying this dependency exposed the test platform to future advisories in a component it no longer needs.</p> <p>"Removing Newtonsoft.Json is part of the broader effort to eliminate unnecessary dependencies that could become security liabilities," said the VSTest engineering team. "System.Text.Json and JSONite offer equivalent serialization performance while keeping the platform secure."</p> <h3 id="background">Background: A Long-Standing Dependency</h3> <p>VSTest had included Newtonsoft.Json for years, even though it was not required for core functionality. The wire format for VSTest messages remains unchanged, ensuring backward compatibility. Older test hosts will still work with the updated platform, and vice versa.</p> <h3 id="what-this-means">What This Means for Developers</h3> <p><strong>For most projects, this is a non-event.</strong> Test projects that do not use Newtonsoft.Json, or that already reference it as a normal <code>PackageReference</code>, will see no difference. xUnit and NUnit projects running on .NET or using AppDomains already required an explicit reference, so they are unaffected.</p> <p><em>However, if your test project uses Newtonsoft.Json types (like <code>JObject</code> or <code>JsonConvert</code>) without declaring a package reference, you will now get a build error.</em> Previously, the reference leaked through VSTest. The fix is simple: add the package.</p> <h3 id="affected-projects">Who Is Affected and How to Fix</h3> <p>Every failure below is non-silent and reported in the test run, flowing into TRX and Azure DevOps/GitHub test views.</p> <h4>1. Build Error: Missing Newtonsoft.Json Reference</h4> <p><strong>If you use Newtonsoft.Json types but don't explicitly reference the package,</strong> compilation will fail. Add this to your test project file:</p><figure style="margin:20px 0"><img src="https://uhf.microsoft.com/images/microsoft/RE1Mu3b.png" alt="VSTest Drops Newtonsoft.Json: Critical Security Update in .NET 11 Preview 4" style="width:100%;height:auto;border-radius:8px" loading="lazy"><figcaption style="font-size:12px;color:#666;margin-top:5px">Source: devblogs.microsoft.com</figcaption></figure> <pre><code>&lt;PackageReference Include="Newtonsoft.Json" Version="13.0.3" /&gt;</code></pre> <h4>2. Runtime Error: FileNotFoundException for Newtonsoft.Json</h4> <p>Projects that reference Newtonsoft.Json but <strong>exclude runtime assets</strong> (e.g., <code>&lt;ExcludeAssets&gt;runtime&lt;/ExcludeAssets&gt;</code>) relied on VSTest's copy. After the update, the test run fails with:</p> <blockquote><code>System.IO.FileNotFoundException: Could not load file or assembly 'Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed'.</code></blockquote> <p>Fix: Remove the <code>&lt;ExcludeAssets&gt;runtime&lt;/ExcludeAssets&gt;</code> element, or install Newtonsoft.Json without excluding runtime assets.</p> <h4>3. Extension Load Error in Test Adapters or Data Collectors</h4> <p>Adapters and data collectors that used Newtonsoft.Json <strong>without declaring it as a dependency</strong> will fail at load time. Error example:</p> <blockquote><code>Data collector 'SampleDataCollector' threw an exception during type loading... System.IO.FileNotFoundException: Could not load file or assembly 'Newtonsoft.Json'</code></blockquote> <p>Fix: Add an explicit <code>PackageReference</code> to Newtonsoft.Json 13.0.3 in the adapter/collector project.</p> <h3>What Is Not Changing</h3> <ul> <li><strong>VSTest wire format</strong> remains identical across all serializers.</li> <li>Older test hosts remain compatible with the updated platform, and vice versa.</li> <li>Serialization performance is the same or better with System.Text.Json and JSONite.</li> </ul> <h3>Next Steps for Developers</h3> <p>Check your test projects for any implicit Newtonsoft.Json usage. The safest course is to add an explicit <code>PackageReference</code> to Newtonsoft.Json 13.0.3 if your code depends on it. For projects already referencing it, ensure you are not excluding runtime assets.</p> <p>This change is effective immediately starting <strong>.NET 11 Preview 4</strong> and <strong>Visual Studio 18.8</strong>. No further action is expected from the majority of users.</p>