Complete migration from Newtonsoft.Json to System.Text.Json

Directory.Packages.props

@@ -23,7 +23,6 @@
     <PackageVersion Include="morelinq" Version="4.4.0" />
     <PackageVersion Include="MSTest.TestFramework" Version="4.1.0" />
     <PackageVersion Include="MSTest.Analyzers" Version="4.1.0" />
-    <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageVersion Include="Newtonsoft.Json.Schema" Version="4.0.1" />
     <PackageVersion Include="NuGet.ProjectModel" Version="7.3.0" />
     <PackageVersion Include="NuGet.Versioning" Version="7.3.0" />

src/Microsoft.ComponentDetection.Contracts/BcdeModels/ContainerDetails.cs

@@ -4,12 +4,9 @@ namespace Microsoft.ComponentDetection.Contracts.BcdeModels;
 using System;
 using System.Collections.Generic;
 using System.Text.Json.Serialization;
-using Newtonsoft.Json;
-using Newtonsoft.Json.Serialization;
 
 // Summary:
 //     Details for a docker container
-[JsonObject(MemberSerialization.OptOut, NamingStrategyType = typeof(CamelCaseNamingStrategy))]
 public class ContainerDetails
 {
     // Summary:

src/Microsoft.ComponentDetection.Contracts/BcdeModels/DefaultGraphScanResult.cs

@@ -2,10 +2,7 @@
 namespace Microsoft.ComponentDetection.Contracts.BcdeModels;
 
 using System.Text.Json.Serialization;
-using Newtonsoft.Json;
-using Newtonsoft.Json.Serialization;
 
-[JsonObject(MemberSerialization.OptOut, NamingStrategyType = typeof(CamelCaseNamingStrategy))]
 public class DefaultGraphScanResult : ScanResult
 {
     [JsonPropertyName("dependencyGraphs")]

src/Microsoft.ComponentDetection.Contracts/BcdeModels/DependencyGraphWithMetadata.cs

@@ -3,10 +3,7 @@ namespace Microsoft.ComponentDetection.Contracts.BcdeModels;
 
 using System.Collections.Generic;
 using System.Text.Json.Serialization;
-using Newtonsoft.Json;
-using Newtonsoft.Json.Serialization;
 
-[JsonObject(MemberSerialization.OptOut, NamingStrategyType = typeof(CamelCaseNamingStrategy))]
 public class DependencyGraphWithMetadata
 {
     [JsonPropertyName("graph")]

src/Microsoft.ComponentDetection.Contracts/BcdeModels/Detector.cs

@@ -4,11 +4,7 @@ namespace Microsoft.ComponentDetection.Contracts.BcdeModels;
 using System.Collections.Generic;
 using System.Text.Json.Serialization;
 using Microsoft.ComponentDetection.Contracts.TypedComponent;
-using Newtonsoft.Json;
-using Newtonsoft.Json.Converters;
-using Newtonsoft.Json.Serialization;
 
-[JsonObject(MemberSerialization.OptOut, NamingStrategyType = typeof(CamelCaseNamingStrategy))]
 public class Detector
 {
     [JsonPropertyName("detectorId")]
@@ -20,7 +16,6 @@ public class Detector
     [JsonPropertyName("version")]
     public int Version { get; set; }
 
-    [JsonProperty(ItemConverterType = typeof(StringEnumConverter))]
     [JsonPropertyName("supportedComponentTypes")]
     public IEnumerable<ComponentType> SupportedComponentTypes { get; set; }
 }

src/Microsoft.ComponentDetection.Contracts/BcdeModels/ScanResult.cs

@@ -3,11 +3,7 @@ namespace Microsoft.ComponentDetection.Contracts.BcdeModels;
 
 using System.Collections.Generic;
 using System.Text.Json.Serialization;
-using Newtonsoft.Json;
-using Newtonsoft.Json.Converters;
-using Newtonsoft.Json.Serialization;
 
-[JsonObject(MemberSerialization.OptOut, NamingStrategyType = typeof(CamelCaseNamingStrategy))]
 public class ScanResult
 {
     [JsonPropertyName("componentsFound")]
@@ -22,7 +18,7 @@ public class ScanResult
     [JsonPropertyName("containerDetailsMap")]
     public Dictionary<int, ContainerDetails> ContainerDetailsMap { get; set; }
 
-    [Newtonsoft.Json.JsonConverter(typeof(StringEnumConverter))]
+    [JsonConverter(typeof(JsonStringEnumConverter))]
     [JsonPropertyName("resultCode")]
     public ProcessingResultCode ResultCode { get; set; }
 

src/Microsoft.ComponentDetection.Contracts/BcdeModels/ScannedComponent.cs

@@ -3,11 +3,7 @@ namespace Microsoft.ComponentDetection.Contracts.BcdeModels;
 
 using System.Collections.Generic;
 using System.Text.Json.Serialization;
-using Newtonsoft.Json;
-using Newtonsoft.Json.Converters;
-using Newtonsoft.Json.Serialization;
 
-[JsonObject(MemberSerialization.OptOut, NamingStrategyType = typeof(CamelCaseNamingStrategy))]
 public class ScannedComponent
 {
     [JsonPropertyName("locationsFoundAt")]
@@ -22,7 +18,7 @@ public class ScannedComponent
     [JsonPropertyName("isDevelopmentDependency")]
     public bool? IsDevelopmentDependency { get; set; }
 
-    [Newtonsoft.Json.JsonConverter(typeof(StringEnumConverter))]
+    [JsonConverter(typeof(JsonStringEnumConverter))]
     [JsonPropertyName("dependencyScope")]
     public DependencyScope? DependencyScope { get; set; }
 
@@ -41,13 +37,11 @@ public class ScannedComponent
     [JsonPropertyName("targetFrameworks")]
     public ISet<string> TargetFrameworks { get; set; }
 
-    [JsonProperty("licensesConcluded", NullValueHandling = NullValueHandling.Ignore)]
     [JsonPropertyName("licensesConcluded")]
-    [System.Text.Json.Serialization.JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     public IList<string> LicensesConcluded { get; set; }
 
-    [JsonProperty("suppliers", NullValueHandling = NullValueHandling.Ignore)]
     [JsonPropertyName("suppliers")]
-    [System.Text.Json.Serialization.JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     public IList<TypedComponent.ActorInfo> Suppliers { get; set; }
 }

src/Microsoft.ComponentDetection.Contracts/BcdeModels/TypedComponentMapping.cs

@@ -7,7 +7,7 @@ namespace Microsoft.ComponentDetection.Contracts.BcdeModels;
 
 /// <summary>
 /// Provides a shared mapping between component type discriminator strings and their corresponding concrete TypedComponent types.
-/// This mapping is used by both Newtonsoft.Json and System.Text.Json converters for polymorphic serialization.
+/// This mapping is used by System.Text.Json converters for polymorphic serialization.
 /// </summary>
 internal static class TypedComponentMapping
 {

src/Microsoft.ComponentDetection.Contracts/Microsoft.ComponentDetection.Contracts.csproj

@@ -11,10 +11,9 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Logging" />
-    <PackageReference Include="Newtonsoft.Json" />
     <PackageReference Include="packageurl-dotnet" />
     <PackageReference Include="System.Memory" />
     <PackageReference Include="System.Reactive" />
     <PackageReference Include="System.Threading.Tasks.Dataflow" />
   </ItemGroup>
-</Project>
+</Project>

src/Microsoft.ComponentDetection.Contracts/TypedComponent/ActorInfo.cs

@@ -1,39 +1,32 @@
 namespace Microsoft.ComponentDetection.Contracts.TypedComponent;
 
 using System;
-using Newtonsoft.Json;
-using Newtonsoft.Json.Serialization;
-using SystemTextJson = System.Text.Json.Serialization;
+using System.Text.Json.Serialization;
 
 /// <summary>
 /// Represents an actor (person, organization, or software agent) involved with a component.
 /// At least one of <see cref="Name"/>, <see cref="Email"/>, or <see cref="Url"/> should be populated.
 /// Aligned with SPDX 3.0.1 Agent subclasses.
 /// </summary>
-[JsonObject(MemberSerialization.OptOut, NamingStrategyType = typeof(CamelCaseNamingStrategy))]
 public class ActorInfo : IEquatable<ActorInfo>
 {
-    [SystemTextJson.JsonPropertyName("name")]
-    [SystemTextJson.JsonIgnore(Condition = SystemTextJson.JsonIgnoreCondition.WhenWritingNull)]
-    [JsonProperty("name", NullValueHandling = NullValueHandling.Ignore)]
+    [JsonPropertyName("name")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     public string? Name { get; set; }
 
-    [SystemTextJson.JsonPropertyName("email")]
-    [SystemTextJson.JsonIgnore(Condition = SystemTextJson.JsonIgnoreCondition.WhenWritingNull)]
-    [JsonProperty("email", NullValueHandling = NullValueHandling.Ignore)]
+    [JsonPropertyName("email")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     public string? Email { get; set; }
 
-    [SystemTextJson.JsonPropertyName("url")]
-    [SystemTextJson.JsonIgnore(Condition = SystemTextJson.JsonIgnoreCondition.WhenWritingNull)]
-    [JsonProperty("url", NullValueHandling = NullValueHandling.Ignore)]
+    [JsonPropertyName("url")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     public Uri? Url { get; set; }
 
     /// <summary>
     /// The type of actor. One of: "Person", "Organization", or "SoftwareAgent".
     /// </summary>
-    [SystemTextJson.JsonPropertyName("type")]
-    [SystemTextJson.JsonIgnore(Condition = SystemTextJson.JsonIgnoreCondition.WhenWritingNull)]
-    [JsonProperty("type", NullValueHandling = NullValueHandling.Ignore)]
+    [JsonPropertyName("type")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     public string? Type { get; set; }
 
     /// <inheritdoc/>

src/Microsoft.ComponentDetection.Contracts/TypedComponent/TypedComponent.cs

@@ -5,28 +5,19 @@ namespace Microsoft.ComponentDetection.Contracts.TypedComponent;
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.Linq;
+using System.Text.Json.Serialization;
 using Microsoft.ComponentDetection.Contracts.BcdeModels;
-using Newtonsoft.Json;
-using Newtonsoft.Json.Converters;
-using Newtonsoft.Json.Serialization;
 using PackageUrl;
-using JsonConverterAttribute = Newtonsoft.Json.JsonConverterAttribute;
-using JsonIgnoreAttribute = Newtonsoft.Json.JsonIgnoreAttribute;
-using SystemTextJson = System.Text.Json.Serialization;
 
-[JsonObject(MemberSerialization.OptOut, NamingStrategyType = typeof(CamelCaseNamingStrategy))]
-[JsonConverter(typeof(TypedComponentConverter))] // Newtonsoft.Json
 [DebuggerDisplay("{DebuggerDisplay,nq}")]
-[SystemTextJson.JsonConverter(typeof(TypedComponentSystemTextJsonConverter))] // System.Text.Json
+[JsonConverter(typeof(TypedComponentSystemTextJsonConverter))]
 public abstract class TypedComponent
 {
 #pragma warning disable IDE0032 // Use auto property - backing fields needed for lazy ??= initialization
-    [JsonIgnore] // Newtonsoft.Json
-    [SystemTextJson.JsonIgnore] // System.Text.Json
+    [JsonIgnore]
     private string id;
 
-    [JsonIgnore] // Newtonsoft.Json
-    [SystemTextJson.JsonIgnore] // System.Text.Json
+    [JsonIgnore]
     private string baseId;
 #pragma warning restore IDE0032
 
@@ -36,9 +27,7 @@ internal TypedComponent()
     }
 
     /// <summary>Gets the type of the component, must be well known.</summary>
-    [JsonConverter(typeof(StringEnumConverter))] // Newtonsoft.Json
-    [JsonProperty("type", Order = int.MinValue)] // Newtonsoft.Json
-    [SystemTextJson.JsonIgnore] // System.Text.Json - type is handled by TypedComponentSystemTextJsonConverter
+    [JsonIgnore] // type is handled by TypedComponentSystemTextJsonConverter
     public abstract ComponentType Type { get; }
 
     /// <summary>
@@ -47,48 +36,41 @@ internal TypedComponent()
     /// When no optional metadata is present, this is identical to <see cref="BaseId"/>.
     /// When optional metadata is present, the format is: <c>BaseId [optionalProp1:value1 optionalProp2:value2]</c>.
     /// </summary>
-    [JsonProperty("id")] // Newtonsoft.Json
-    [SystemTextJson.JsonPropertyName("id")] // System.Text.Json
+    [JsonPropertyName("id")]
     public string Id => this.id ??= this.ComputeId();
 
     /// <summary>
     /// Gets the base identifier for this component, derived solely from required identity fields
     /// (e.g., name, version, type). Use this when comparing components by package identity alone,
     /// without considering provenance metadata such as download or source URLs.
     /// </summary>
-    [JsonIgnore] // Newtonsoft.Json
-    [SystemTextJson.JsonIgnore] // System.Text.Json
+    [JsonIgnore]
     public string BaseId => this.baseId ??= this.ComputeBaseId();
 
-    [SystemTextJson.JsonPropertyName("packageUrl")]
+    [JsonPropertyName("packageUrl")]
     public virtual PackageURL PackageUrl { get; }
 
     /// <summary>Gets or sets SPDX license expression(s) declared by the package author.</summary>
-    [JsonProperty("licenses", NullValueHandling = NullValueHandling.Ignore)]
-    [SystemTextJson.JsonIgnore(Condition = SystemTextJson.JsonIgnoreCondition.WhenWritingNull)]
-    [SystemTextJson.JsonPropertyName("licenses")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("licenses")]
     public virtual IList<string> Licenses { get; set; }
 
     /// <summary>Gets or sets structured author/creator identity (SPDX 3.0.1 originatedBy).</summary>
-    [JsonProperty("authorsInfo", NullValueHandling = NullValueHandling.Ignore)]
-    [SystemTextJson.JsonIgnore(Condition = SystemTextJson.JsonIgnoreCondition.WhenWritingNull)]
-    [SystemTextJson.JsonPropertyName("authorsInfo")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("authorsInfo")]
     public virtual IList<ActorInfo> AuthorsInfo { get; set; }
 
     /// <summary>Gets or sets the direct download URL for the package binary.</summary>
-    [JsonProperty("downloadUrl", NullValueHandling = NullValueHandling.Ignore)]
-    [SystemTextJson.JsonIgnore(Condition = SystemTextJson.JsonIgnoreCondition.WhenWritingNull)]
-    [SystemTextJson.JsonPropertyName("downloadUrl")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("downloadUrl")]
     public virtual Uri DownloadUrl { get; set; }
 
     /// <summary>Gets or sets the source code repository URL.</summary>
-    [JsonProperty("sourceUrl", NullValueHandling = NullValueHandling.Ignore)]
-    [SystemTextJson.JsonIgnore(Condition = SystemTextJson.JsonIgnoreCondition.WhenWritingNull)]
-    [SystemTextJson.JsonPropertyName("sourceUrl")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("sourceUrl")]
     public virtual Uri SourceUrl { get; set; }
 
-    [JsonIgnore] // Newtonsoft.Json
-    [SystemTextJson.JsonIgnore] // System.Text.Json
+    [JsonIgnore]
     internal string DebuggerDisplay => $"{this.Id}";
 
     protected string ValidateRequiredInput(string input, string fieldName, string componentType)

src/Microsoft.ComponentDetection.Detectors/Microsoft.ComponentDetection.Detectors.csproj

@@ -20,7 +20,6 @@
         <PackageReference Include="SemanticVersioning" />
         <PackageReference Include="yamldotnet" />
         <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
-        <PackageReference Include="Newtonsoft.Json" />
         <PackageReference Include="System.Reactive" />
         <PackageReference Include="System.Threading.Tasks.Dataflow" />
         <PackageReference Include="Tomlyn.Signed" />

src/Microsoft.ComponentDetection.Orchestrator/Microsoft.ComponentDetection.Orchestrator.csproj

@@ -11,7 +11,6 @@
         <PackageReference Include="Microsoft.Extensions.FileSystemGlobbing" />
         <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
         <PackageReference Include="Microsoft.Extensions.Logging" />
-        <PackageReference Include="Newtonsoft.Json" />
         <PackageReference Include="Polly" />
         <PackageReference Include="Serilog" />
         <PackageReference Include="Serilog.Sinks.Async" />