If you've been using VSTest—the engine behind dotnet test and Visual Studio's Test Explorer—get ready for a significant shift. Starting with .NET 11 Preview 4 and Visual Studio 18.8, VSTest will no longer ship with Newtonsoft.Json. Instead, it will rely on System.Text.Json (for .NET) and JSONite (for .NET Framework). This change is purely about security and servicing, and while the vast majority of test projects won't notice a thing, a handful may need a simple one-line fix. Below are the five essential things you need to know to prepare your projects and avoid any surprises.
1. What’s Actually Changing in VSTest?
For years, VSTest bundled Newtonsoft.Json as a dependency, which leaked into test projects—meaning they could use Newtonsoft.Json types like JObject without explicitly adding a package reference. Now, that implicit availability is gone. The platform swaps in System.Text.Json on modern .NET and JSONite on .NET Framework for its own internal serialization. This is a servicing and security move: all Newtonsoft.Json versions below 13.0.0 are flagged as vulnerable on NuGet.org, and carrying a package you don't actually need just exposed you to future advisories. By removing it, the .NET SDK team reduces the attack surface and aligns with their broader effort to phase out Newtonsoft.Json across the toolchain. The good news? For most users, this swap is invisible—your tests will run exactly as before, but with one less potential security risk lurking in the background.
2. Why Newtonsoft.Json Had to Go
The decision wasn't arbitrary. Every version of Newtonsoft.Json below 13.0.0 now carries a security advisory on NuGet.org. Since VSTest didn't actually need the library—it only used it for its own internal messaging (which has now been replaced)—keeping it meant the entire .NET SDK and Visual Studio inherited a vulnerable dependency without any real benefit. Furthermore, the .NET team has been systematically removing Newtonsoft.Json from the SDK for a while; this is just the latest step. By cutting the cord, they prevent future CVEs from automatically affecting the test platform. Even if you never use Newtonsoft.Json yourself, its presence in the SDK could flag your build system as vulnerable. This change removes that false positive risk and streamlines the SDK, making it leaner and more secure. In short: it's a proactive cleanup that benefits everyone, even if you don't notice it.
3. What Stays Exactly the Same
Despite the internal swap, many things remain unchanged. The VSTest wire format is identical—messages are serialized in the same way whether Newtonsoft.Json, System.Text.Json, or JSONite does the work. Older test hosts (the executables that run your tests) remain fully compatible with the updated test platform, and vice versa. You won't see any breaking changes in your test results, logs, or output formats like TRX. Serialization performance is either the same or better, thanks to System.Text.Json's optimized design. So if your project doesn't directly rely on Newtonsoft.Json, you can safely ignore this update—the test infrastructure will handle everything transparently. Also, the way you write tests, assertions, and test fixtures has not changed at all. This is purely an infrastructure-level adjustment, not a feature change or API overhaul. Your existing test code will continue to work without modifications.
4. Who Won’t Be Affected?
The large majority of test projects fall into the safe zone. This includes:
- Projects that do not use Newtonsoft.Json at all.
- Projects that already have a proper PackageReference to Newtonsoft.Json.
- xUnit and NUnit projects running on .NET, or those using AppDomains, because those already required an explicit Newtonsoft.Json reference.
If you fit any of these categories, you can upgrade to the new .NET SDK and Visual Studio without any action. Your tests will compile and run exactly as before. The hidden dependency that VSTest provided was always a convenience, not a contractual guarantee. Microsoft has been clear that you should always explicitly reference any Newtonsoft.Json you use. So if you've been following best practices, this change is a non-event. In fact, it's actually a small improvement—your project dependencies become more transparent and less reliant on accidental transitive inclusions.
5. Who Is Affected and the One-Line Fix
A small set of projects will see obvious, non-silent failures—either at build time or test runtime. These failures are reported clearly in the test run output, TRX files, and Azure DevOps/GitHub test views. Here are the three scenarios:
Build Error: Missing Newtonsoft.Json Reference
If your test project uses Newtonsoft.Json types (like JObject or JsonConvert) without referencing the NuGet package, it previously compiled only because VSTest leaked the assembly. After the update, the build breaks. Fix: Add a proper PackageReference:
<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />Runtime Error: FileNotFoundException
Projects that reference Newtonsoft.Json but use <ExcludeAssets>runtime</ExcludeAssets> will fail at test runtime with FileNotFoundException. They relied on VSTest's copy being available, which is now gone. Fix: Remove <ExcludeAssets>runtime</ExcludeAssets> or install Newtonsoft.Json without excluding runtime assets.
Extension Load Error
Test adapters and data collectors that used Newtonsoft.Json without declaring it as a dependency will fail at load time. Fix: Add a direct dependency on Newtonsoft.Json 13.0.3 (or later) to your extension package. These failures are easy to diagnose because they come with clear error messages pointing to the missing assembly.
In all cases, the fix is a single line change—either adding a package reference or adjusting your existing one. No code rewrites, no test changes, just dependency clarity.
Conclusion
The removal of Newtonsoft.Json from VSTest is a positive, security‑driven improvement that makes the .NET SDK more robust and easier to audit. For the vast majority of developers, this change will be completely invisible. If you are in the affected minority, the resolved errors are straightforward and non‑disruptive. By taking a moment to check your project dependencies now, you can avoid surprises when you upgrade to .NET 11 Preview 4 or Visual Studio 18.8. Ultimately, this move simplifies the toolchain, reduces security exposure, and encourages better dependency management practices. It's a win for the entire .NET ecosystem.