VSTest Drops Newtonsoft.Json: Key Questions Answered

The testing platform VSTest, which powers dotnet test and Test Explorer, is removing its dependency on Newtonsoft.Json starting in .NET 11 Preview 4 and Visual Studio 18.8. This move is part of a broader effort to eliminate Newtonsoft.Json from the .NET SDK for security reasons. Most test projects will see no impact, but a small subset may encounter build or runtime errors. Below, we answer the most common questions about this change and how to adapt.

Why is VSTest removing Newtonsoft.Json?

VSTest had included Newtonsoft.Json in the .NET SDK and Visual Studio for many years. However, all versions of Newtonsoft.Json below 13.0.0 are now flagged as vulnerable on NuGet.org. Continuing to ship this dependency exposes the test platform to future security advisories in a component it no longer needs. The removal is part of a wider initiative to phase out Newtonsoft.Json from the entire .NET SDK, reducing the attack surface and simplifying dependency management.

VSTest Drops Newtonsoft.Json: Key Questions Answered — Source: devblogs.microsoft.com

What exactly is changing under the hood?

On .NET, VSTest now uses System.Text.Json for serialization. On .NET Framework, it uses JSONite. Importantly, the wire format used for communication between VSTest and test hosts remains unchanged. Messages are serialized identically regardless of which JSON library is employed. This means older test hosts remain fully compatible with the updated platform, and vice versa. Performance is either equal or improved, so there is no downside in terms of speed.

Which projects are unaffected by this change?

The vast majority of test projects fall into the unaffected category:

Projects that do not use Newtonsoft.Json at all.
Projects that already have a normal PackageReference to Newtonsoft.Json (without excluding assets).
Projects using xUnit or NUnit running on .NET, or that use AppDomains—these already required an explicit Newtonsoft.Json reference.

For these projects, no action is required. All changes are non-silent, so any issues will be clearly reported in the test run output, TRX files, and Azure DevOps or GitHub test views.

What if I get a build error saying Newtonsoft.Json is missing?

This occurs if your test project uses Newtonsoft.Json types (like JObject or JsonConvert) but does not declare a package reference. Previously, the library was available indirectly through VSTest. After the update, the explicit reference is required. The fix is simple:

<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />

Add this line to your project file, and the build will succeed.

How do I fix a runtime FileNotFoundException for Newtonsoft.Json?

Some projects reference Newtonsoft.Json but exclude its runtime asset, like:

<PackageReference Include="Newtonsoft.Json" Version="13.0.3">
  <ExcludeAssets>runtime</ExcludeAssets>
</PackageReference>

These projects relied on VSTest’s bundled copy at test time. After the change, the test run will throw:

System.IO.FileNotFoundException: Could not load file or assembly 'Newtonsoft.Json, Version=13.0.0.0, ...'

To resolve, either remove the <ExcludeAssets>runtime</ExcludeAssets> element, or install Newtonsoft.Json without excluding runtime assets. Either approach ensures the assembly is available during test execution.

What if a test adapter or data collector fails to load?

Adapters and data collectors that internally used Newtonsoft.Json without declaring it as a dependency will fail at load time with a message like:

Data collector 'SampleDataCollector' threw an exception during type loading: System.IO.FileNotFoundException: ...

If you develop or maintain such an extension, update its dependencies to include a direct reference to Newtonsoft.Json (preferably version 13.0.3). Alternatively, rewrite the extension to use System.Text.Json. For third-party adapters, contact the publisher or check for an updated version that addresses this change.

Tags: