5 Critical Changes After VSTest Removes Its Newtonsoft.Json Dependency

Starting with .NET 11 Preview 4 and Visual Studio 18.8, the VSTest platform—which powers both dotnet test and Test Explorer—has officially stopped depending on Newtonsoft.Json. Instead, it now uses System.Text.Json on .NET and JSONite on .NET Framework. This move is a servicing and security upgrade. While most projects won't notice a difference, a small subset may encounter build or runtime failures. Here are the five essential things you need to know about this change, from why it happened to how to fix any issues that arise.

1. The Core Change: VSTest Switches JSON Libraries

For years, Newtonsoft.Json was bundled inside VSTest, making it available to test projects without them explicitly adding it. As of .NET 11 Preview 4 and Visual Studio 18.8, that's no longer the case. VSTest has replaced Newtonsoft.Json with System.Text.Json on .NET and JSONite on .NET Framework. This means the test platform no longer ships its own copy of Newtonsoft.Json. If your test project relied on that invisible dependency to compile or run, you'll now need to add Newtonsoft.Json yourself. The change is purely about removing an unnecessary component—Newtonsoft.Json is not required for VSTest's own serialization anymore.

2. Why Newtonsoft.Json Had to Go

The primary driver is security. All versions of Newtonsoft.Json below 13.0.0 are flagged as vulnerable on NuGet.org. Carrying this dependency exposed the test platform to future advisories for a component it no longer needs. Removing it is part of a broader initiative to eliminate Newtonsoft.Json from the entire .NET SDK. In short, this is a proactive security patch. Even if your project never uses Newtonsoft.Json directly, having it present in the toolchain adds unnecessary risk. By dropping it, Microsoft ensures that VSTest's attack surface shrinks, and developers don't inherit a vulnerable package by accident.

3. What Remains Unchanged

Don't worry about your test reports or communication between test host and runner. The VSTest wire format has not changed—messages serialize identically whether using Newtonsoft.Json, System.Text.Json, or JSONite. Older test hosts remain fully compatible with the updated platform, and vice versa. Performance is at least as good as before; in many cases it's better. So if your project doesn't directly use Newtonsoft.Json types like JObject or JsonConvert, you won't see any difference in behavior or speed. The only change is under the hood, where one JSON parser has been swapped for another.

4. Who Is Not Affected

The vast majority of test projects fall into this safe category. If you don't use Newtonsoft.Json at all, you're fine. If you already reference Newtonsoft.Json as a normal PackageReference (without excluding runtime assets), you're also fine. xUnit and NUnit projects running on .NET or using AppDomains already needed an explicit reference, so they remain unaffected. In short, anyone who has a proper, explicit dependency on Newtonsoft.Json—or no dependency at all—will experience zero issues. The only people who need to act are those who were accidentally relying on VSTest's bundled copy.

5. How to Fix the Three Types of Failures

If you see a build error, a runtime FileNotFoundException, or an extension load failure, here's how to resolve each. Build error: Your test project uses Newtonsoft.Json types but doesn't reference the package. Fix: add <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />. Runtime error: Your project references Newtonsoft.Json but excludes runtime assets (e.g., <ExcludeAssets>runtime</ExcludeAssets>). Fix: remove that exclusion or install without excluding runtime. Extension error: A test adapter or data collector uses Newtonsoft.Json without declaring it. Fix: add a direct dependency to that extension's project. All failures are non-silent and appear in TRX files and CI/CD views, so you'll know exactly what's wrong.

In summary, VSTest's removal of Newtonsoft.Json is a security-focused improvement that barely affects most developers. If you do hit an issue, the fix is trivial—add a single package reference or remove an exclusion. This change makes the .NET SDK leaner and safer without sacrificing compatibility or performance.