dotnet / dotnet/runtime

Compliance: Remove RapidJson dependency

Open
#131,478 7 comments 0 reactions 0 assignees View on GitHub
area-Host
Dominant language
C#
Stars
18.3k
Forks
5.6k
PR merge metrics
PR metrics pending

Description

tl;dr: We need to remove our dependency on RapidJson in .NET 12. We should also strongly consider removing it from servicing branches after we stabilize its removal from .NET 12.

---

There's a coming compliance effort within MSFT to rid repos of out-of-date / unsupported dependencies. The first wave of this will almost certainly involve flagging usage of RapidJson, which is generally viewed as an abandoned project.

(Edit - we're already receiving alerts on this. What's being proposed is _enforcement_.)

To be clear: **our own usage of RapidJson is secure**, but the amount of paperwork and toil that's going to be required to keep this dependency around is almost certainly not going to be worth our time. Additionally, since RapidJson presumably shows up in our SBOMs, customers who run their own compliance scans (or who outsource such scans to third-party tooling) will start receiving similar alerts as the industry at large moves toward reducing stale dependencies. We've seen this before with complaints re: out-of-date versions of zlib; even though customers were never realistically exposed to any vulnerability, it simply caused too much pain for too many parties, and we changed our servicing policy to accommodate it.

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by locating RapidJson references and dependency declarations in the repository, then trace which .NET 12 and servicing-branch components use them. Done means the dependency is removed from .NET 12 and the relevant validation passes; consider servicing branches after the .NET 12 removal stabilizes.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
build-system
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.