Understanding VSTest's Move Away from Newtonsoft.Json: Key Questions and Answers

The VSTest test platform, which powers dotnet test and Test Explorer, is undergoing a significant shift starting with .NET 11 Preview 4 and Visual Studio 18.8. It will no longer depend on Newtonsoft.Json, replacing it with System.Text.Json for .NET and JSONite for .NET Framework. This change is driven by security concerns—all versions below 13.0.0 are flagged as vulnerable—and aligns with the broader effort to remove Newtonsoft.Json from the .NET SDK. Below we address the most important questions about this transition, from who is affected to step-by-step fixes.

Why is VSTest removing Newtonsoft.Json?
What replaces Newtonsoft.Json in VSTest?
Will my existing test projects break?
How do I fix build errors from a missing Newtonsoft.Json reference?
What runtime errors might occur, and how to fix them?
Are test adapters or data collectors affected?

Why is VSTest removing its dependency on Newtonsoft.Json?

VSTest has shipped Newtonsoft.Json as part of the .NET SDK and Visual Studio for years. However, all versions of Newtonsoft.Json below 13.0.0 are now marked as vulnerable on NuGet.org. Carrying this dependency exposes the test platform to future security advisories in a component it no longer needs. Removing Newtonsoft.Json is a proactive servicing and security measure, and it’s part of a larger initiative to eliminate that library from the entire .NET SDK. The change takes effect in .NET 11 Preview 4 and Visual Studio 18.8. Most projects won’t notice the difference, but a small number may see build or test failures that are easy to fix.

Understanding VSTest's Move Away from Newtonsoft.Json: Key Questions and Answers — Source: devblogs.microsoft.com

What replaces Newtonsoft.Json in VSTest?

The replacement depends on the runtime. On .NET, VSTest now uses System.Text.Json, Microsoft’s modern, high-performance JSON library. On .NET Framework, it switches to JSONite, a lightweight embedded JSON parser. Both alternatives meet VSTest’s internal serialization needs without introducing the same security surface. Importantly, the wire format remains unchanged—messages serialize identically whether Newtonsoft.Json, System.Text.Json, or JSONite is used. This means older test hosts stay compatible with the updated platform, and vice versa. Serialization performance is the same or better after the switch.

Will my existing test projects break after this change?

Most test projects will not break. You’re unaffected if:

Your project doesn’t use Newtonsoft.Json at all.
You already have an explicit PackageReference to Newtonsoft.Json.
You’re using xUnit or NUnit on .NET (or with AppDomains)—these frameworks already required an explicit reference, so no hidden dependency existed.

However, a small number of projects that indirectly relied on Newtonsoft.Json leaking through VSTest will experience non-silent failures—reported in the test run, TRX files, and test views in Azure DevOps or GitHub. These failures are easy to diagnose and fix.

How do I fix build errors from a missing Newtonsoft.Json reference?

If your test project uses Newtonsoft.Json types—like JObject or JsonConvert—without referencing the package directly, it previously compiled only because VSTest’s copy was available. After the update, you’ll see a build error. The fix is simple: add an explicit PackageReference to your project file:

<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />

This ensures your project has its own copy. Version 13.0.3 is the latest stable and safe. Once added, the build error will disappear, and your tests will run normally.

What runtime errors might occur, and how to fix them?

Some projects reference Newtonsoft.Json but exclude the runtime asset, like this:

<PackageReference Include="Newtonsoft.Json" Version="13.0.3">
  <ExcludeAssets>runtime</ExcludeAssets>
</PackageReference>

They previously relied on VSTest’s copy at test time. After the update, you’ll get a FileNotFoundException for Newtonsoft.Json at runtime. The fix is to remove the <ExcludeAssets>runtime</ExcludeAssets> element, or install the package without excluding runtime assets. Simply edit your project file and save; the error will resolve on the next test run.

Are test adapters or data collectors affected?

Yes. Test adapters and data collectors that used Newtonsoft.Json without declaring it as a dependency will fail at load time with an error like:

Data collector 'SampleDataCollector' threw an exception during type loading, construction, or initialization: System.IO.FileNotFoundException: Could not load file or assembly 'Newtonsoft.Json, Version=13.0.0.0, ...

To fix this, the extension author must add an explicit PackageReference to Newtonsoft.Json (version 13.0.3) in the extension’s project. If you are the consumer of such an extension, contact the maintainer to request an update. The error is not silent—it appears in test logs and the test explorer, making it straightforward to identify and report.

Tags: