dotnet / dotnet/sdk

Remove `Newtonsoft.Json` from the .NET SDK installation

Open
#53,287 8 comments 12 reactions 0 assignees View on GitHub
Area-Install untriaged
Dominant language
C#
Stars
3.2k
Forks
1.3k
PR merge metrics
PR metrics pending

Description

## Summary
The .NET SDK currently ships the `Newtonsoft.Json` assembly in several locations within the SDK layout. We should remove this dependency from the SDK by eliminating project references that bring it in and migrating usages to `System.Text.Json` where possible.

Removing this dependency would reduce the SDK servicing surface area, decrease SDK size, and unblock work related to Native AOT.

## Motivation

### Security / Servicing
Bundling `Newtonsoft.Json` in the SDK introduces an additional dependency that must be monitored and serviced for potential security vulnerabilities.

Migrating to `System.Text.Json` reduces this servicing burden because it ships as part of the .NET platform and is already covered by the platform servicing model.

### SDK Size Reduction
Removing `Newtonsoft.Json` would also help reduce the size of the SDK installation.

Historically the SDK contained multiple copies of this assembly. Deduplication work reduced this to two primary copies, but it still contributes unnecessary size to the SDK.

Related work:
- https://github.com/dotnet/sdk/issues/52182

### Native AOT Compatibility
Usage of `Newtonsoft.Json` is a blocker for some Native AOT scenarios due to its heavy reliance on reflection and dynamic behavior. Migrating to `System.Text.Json` helps unblock this work.

Related work:
- https://github.com/dotnet/sdk/issues/49667

## Current Locations in the SDK
The following instances of `Newtonsoft.Json.dll` currently appear in the SDK layout:

- [x] ./DotnetTools/dotnet-user-secrets/11.0.0-preview.3.26152.106/tools/net11.0/any/Newtonsoft.Json.dll - https://github.com/dotnet/aspnetcore/pull/65686
- [x] ./TestHostNetFramework/Newtonsoft.Json.dll
- [ ] ./Newtonsoft.Json.dll
- [ ] ./Sdks/Microsoft.NET.Sdk/tools/net472/Newtonsoft.Json.dll
- [x] ./Sdks/Microsoft.NET.Sdk.Razor/tools/Newtonsoft.Json.dll - https://github.com/dotnet/sdk/pull/53345

## Migration Guideline

https://learn.microsoft.com/en-us/dotnet/standard/serialization/system-text-json/migrate-from-newtonsoft?pivots=dotnet-10-0

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.