Starting with .NET 11 Preview 4 and Visual Studio 18.8, the VSTest platform—which underpins dotnet test and Test Explorer—will no longer include Newtonsoft.Json. Instead, it will use System.Text.Json on .NET and JSONite on .NET Framework. This security-driven update is mostly transparent, but a few projects require minor adjustments. Below, we answer the key questions about what's changing, who is affected, and how to resolve any issues.
Why is VSTest removing Newtonsoft.Json?
VSTest has shipped Newtonsoft.Json as part of the .NET SDK and Visual Studio for many years. All versions of Newtonsoft.Json below 13.0.0 are now flagged as vulnerable on NuGet.org. Keeping this dependency exposes the test platform to future security advisories in a component it no longer needs. Removing it aligns with the broader effort to eliminate Newtonsoft.Json from the .NET SDK entirely, reducing attack surface and maintenance overhead. The change is purely servicing and security-focused; no functional improvements are intended.
What parts of VSTest remain unchanged?
Three key aspects stay the same:
- Wire format: Messages serialize identically regardless of which JSON library (Newtonsoft.Json, System.Text.Json, or JSONite) is used.
- Backward compatibility: Older test hosts continue to work with the updated platform, and vice versa.
- Performance: Serialization speed is at least as good as before, often better with the more streamlined libraries.
Which test projects are not affected?
Most test projects fall into the unaffected category. Specifically:
- Projects that do not use Newtonsoft.Json at all.
- Projects that already have Newtonsoft.Json as an explicit
PackageReferencein their own project file. - xUnit and NUnit projects running on .NET (or using AppDomains), because those already required an explicit Newtonsoft.Json reference.
If your project fits any of these descriptions, no action is needed—the removal will not impact your builds or test runs.
What should I do if I get a build error about a missing Newtonsoft.Json reference?
This error occurs only if your test code uses Newtonsoft.Json types (like JObject or JsonConvert) but does not list Newtonsoft.Json as a package dependency. Previously, the library leaked through VSTest, so compilation succeeded. After the update, the compiler cannot find the types. The fix is straightforward: add an explicit PackageReference to Newtonsoft.Json version 13.0.3 in your test project:
<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
This error is non-silent and will appear as a build failure in your CI/CD pipeline as well as in local builds.
How do I fix a runtime FileNotFoundException for Newtonsoft.Json?
If your project references Newtonsoft.Json but excludes its runtime assets (e.g., using <ExcludeAssets>runtime</ExcludeAssets>), you previously relied on VSTest's embedded copy at test time. After the update, that copy is gone, and the test run will throw:
System.IO.FileNotFoundException: Could not load file or assembly 'Newtonsoft.Json, Version=13.0.0.0, ...
To resolve, either remove the <ExcludeAssets>runtime</ExcludeAssets> line from your PackageReference, or install Newtonsoft.Json normally without excluding runtime assets. This ensures the assembly is present when tests execute.
What if a test adapter or data collector fails to load due to Newtonsoft.Json?
Some test adapters or data collectors used Newtonsoft.Json internally without declaring it as a dependency. After the update, they will fail at load time with an error like:
Data collector 'SampleDataCollector' threw an exception during type loading: FileNotFoundException: Could not load file or assembly 'Newtonsoft.Json
The fix depends on the adapter's author: they must add a direct dependency on Newtonsoft.Json 13.0.3. If you maintain the adapter, update its project file. If you use a third-party adapter, check for an updated version that includes the dependency. The failure is reported in the test run and flows into TRX and test views, so it will not go unnoticed.
Will this change affect older test hosts or Visual Studio versions?
No. The VSTest platform remains fully compatible with older test hosts. Communication between the updated platform and older hosts uses the unchanged wire format, so both sides can interoperate. Similarly, test projects built with previous Visual Studio versions will work fine. The only requirement is that you update your test project files to handle the three scenarios described above (missing reference, runtime exclusion, or adapter dependency). Once fixed, everything continues to run as before.