fix CVEs (#2929)

AzureAD · Jul 15, 2024 · bf48d7a · bf48d7a
1 parent f5b443e
commit bf48d7a
Show file tree

Hide file tree

Showing 14 changed files with 47 additions and 47 deletions.
diff --git a/Directory.Build.props b/Directory.Build.props
@@ -88,21 +88,25 @@
  <MicrosoftGraphBetaVersion>4.57.0-preview</MicrosoftGraphBetaVersion>
  <MicrosoftExtensionsHttpVersion>3.1.3</MicrosoftExtensionsHttpVersion>
  <MicrosoftIdentityAbstractions>6.0.0</MicrosoftIdentityAbstractions>
- <NetNineRuntimeVersion> 9.0.0-preview.4.24266.19</NetNineRuntimeVersion>
- <AspNetCoreNineRuntimeVersion> 9.0.0-preview.4.24267.6</AspNetCoreNineRuntimeVersion>
+ <NetNineRuntimeVersion>9.0.0-preview.6.24327.7</NetNineRuntimeVersion>
+ <AspNetCoreNineRuntimeVersion>9.0.0-preview.6.24328.4</AspNetCoreNineRuntimeVersion>
+ <!--CVE-2024-30105-->
+ <SystemTextJsonVersion>8.0.4</SystemTextJsonVersion>
+ <!--CVE-2023-29331-->
+ <SystemFormatsAsn1Version>8.0.1</SystemFormatsAsn1Version>
  </PropertyGroup>
 
  <PropertyGroup Condition="'$(TargetFramework)' == 'net9.0'">
  <MicrosoftAspNetCoreAuthenticationJwtBearerVersion>$(AspNetCoreNineRuntimeVersion)</MicrosoftAspNetCoreAuthenticationJwtBearerVersion>
  <MicrosoftAspNetCoreAuthenticationOpenIdConnectVersion>$(AspNetCoreNineRuntimeVersion)</MicrosoftAspNetCoreAuthenticationOpenIdConnectVersion>
  <MicrosoftExtensionsCachingMemoryVersion>$(NetNineRuntimeVersion)</MicrosoftExtensionsCachingMemoryVersion>
- <MicrosoftExtensionsHostingVersion>9.0.100-preview.4.24267.66</MicrosoftExtensionsHostingVersion>
+ <MicrosoftExtensionsHostingVersion>$(NetNineRuntimeVersion)</MicrosoftExtensionsHostingVersion>
  <MicrosoftAspNetCoreDataProtectionVersion>$(AspNetCoreNineRuntimeVersion)</MicrosoftAspNetCoreDataProtectionVersion>
  <SystemSecurityCryptographyPkcsVersion>$(NetNineRuntimeVersion)</SystemSecurityCryptographyPkcsVersion>
  <SystemSecurityCryptographyXmlVersion>$(NetNineRuntimeVersion)</SystemSecurityCryptographyXmlVersion>
  <MicrosoftExtensionsLoggingVersion>$(NetNineRuntimeVersion)</MicrosoftExtensionsLoggingVersion>
- <SystemTextEncodingsWebVersion>9.0.100-preview.4.24267.66</SystemTextEncodingsWebVersion>
- <MicrosoftExtensionsConfigurationBinderVersion>9.0.100-preview.4.24267.66</MicrosoftExtensionsConfigurationBinderVersion>
+ <MicrosoftExtensionsConfigurationBinderVersion>$(NetNineRuntimeVersion)</MicrosoftExtensionsConfigurationBinderVersion>
+ <SystemFormatsAsn1Version>$(NetNineRuntimeVersion)</SystemFormatsAsn1Version>
  <MicrosoftExtensionsDependencyInjectionVersion>$(NetNineRuntimeVersion)</MicrosoftExtensionsDependencyInjectionVersion>
  </PropertyGroup>
 
@@ -111,9 +115,9 @@
  <MicrosoftAspNetCoreAuthenticationOpenIdConnectVersion>8.0.0</MicrosoftAspNetCoreAuthenticationOpenIdConnectVersion>
  <MicrosoftExtensionsCachingMemoryVersion>8.0.0</MicrosoftExtensionsCachingMemoryVersion>
  <MicrosoftExtensionsHostingVersion>8.0.0</MicrosoftExtensionsHostingVersion>
- <MicrosoftAspNetCoreDataProtectionVersion>8.0.0</MicrosoftAspNetCoreDataProtectionVersion>
+ <MicrosoftAspNetCoreDataProtectionVersion>8.0.1</MicrosoftAspNetCoreDataProtectionVersion>
  <SystemSecurityCryptographyPkcsVersion>8.0.0</SystemSecurityCryptographyPkcsVersion>
- <SystemSecurityCryptographyXmlVersion>8.0.0</SystemSecurityCryptographyXmlVersion>
+ <SystemSecurityCryptographyXmlVersion>8.0.1</SystemSecurityCryptographyXmlVersion>
  <MicrosoftExtensionsLoggingVersion>8.0.0</MicrosoftExtensionsLoggingVersion>
  <SystemTextEncodingsWebVersion>8.0.0</SystemTextEncodingsWebVersion>
  <MicrosoftExtensionsConfigurationBinderVersion>8.0.0</MicrosoftExtensionsConfigurationBinderVersion>
@@ -142,6 +146,8 @@
  <MicrosoftAspNetCoreDataProtectionVersion>6.0.0</MicrosoftAspNetCoreDataProtectionVersion>
  <SystemSecurityCryptographyXmlVersion>6.0.1</SystemSecurityCryptographyXmlVersion>
  <!--CVE-2023-29331-->
+ <SystemFormatsAsn1Version>6.0.1</SystemFormatsAsn1Version>
+ <!--CVE-2023-29331-->
  <SystemSecurityCryptographyPkcsVersion>6.0.4</SystemSecurityCryptographyPkcsVersion>
  <!-- CVE-2022-34716 due to DataProtection 5.0.8 -->
  <MicrosoftExtensionsLoggingVersion>6.0.0</MicrosoftExtensionsLoggingVersion>

diff --git a/src/Microsoft.Identity.Web.Certificate/Microsoft.Identity.Web.Certificate.csproj b/src/Microsoft.Identity.Web.Certificate/Microsoft.Identity.Web.Certificate.csproj
@@ -11,10 +11,7 @@
  <PackageReference Include="Azure.Identity" Version="$(AzureIdentityVersion)" />
  <PackageReference Include="Azure.Security.KeyVault.Certificates" Version="$(AzureSecurityKeyVaultCertificatesVersion)" />
  <PackageReference Include="Microsoft.Identity.Abstractions" Version="$(MicrosoftIdentityAbstractions)" />
- </ItemGroup>
-
- <ItemGroup Condition="'$(TargetFrameworkIdentifier)' != '.NETCoreApp'">
- <PackageReference Include="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebVersion)" />
+ <PackageReference Include="System.Text.Json" Version="$(SystemTextJsonVersion)" />
  </ItemGroup>
 
  <ItemGroup>

diff --git a/src/Microsoft.Identity.Web.Certificateless/Microsoft.Identity.Web.Certificateless.csproj b/src/Microsoft.Identity.Web.Certificateless/Microsoft.Identity.Web.Certificateless.csproj
@@ -12,8 +12,8 @@
 
  <ItemGroup>
  <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="$(MicrosoftExtensionsLoggingVersion)" />
- <PackageReference Include="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebVersion)" />
  <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens " Version="$(IdentityModelVersion)" />
  <PackageReference Include="Microsoft.Identity.Client" Version="$(MicrosoftIdentityClientVersion)" />
+ <PackageReference Include="System.Text.Json" Version="$(SystemTextJsonVersion)" />
  </ItemGroup>
 </Project>
diff --git a/src/Microsoft.Identity.Web.TokenAcquisition/Microsoft.Identity.Web.TokenAcquisition.csproj b/src/Microsoft.Identity.Web.TokenAcquisition/Microsoft.Identity.Web.TokenAcquisition.csproj
@@ -31,10 +31,6 @@
  <PackageReference Include="Microsoft.Identity.Abstractions" Version="$(MicrosoftIdentityAbstractions)" />
  </ItemGroup>
 
- <ItemGroup Condition="'$(TargetFrameworkIdentifier)' != '.NETCoreApp'">
- <PackageReference Include="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebVersion)" />
- </ItemGroup>
-
  <ItemGroup>
  <ProjectReference Include="..\Microsoft.Identity.Web.Certificateless\Microsoft.Identity.Web.Certificateless.csproj" />
  <ProjectReference Include="..\Microsoft.Identity.Web.Certificate\Microsoft.Identity.Web.Certificate.csproj" />

diff --git a/src/Microsoft.Identity.Web.TokenCache/Microsoft.Identity.Web.TokenCache.csproj b/src/Microsoft.Identity.Web.TokenCache/Microsoft.Identity.Web.TokenCache.csproj
@@ -9,6 +9,7 @@
 
  <ItemGroup>
  <PackageReference Include="Microsoft.Identity.Client" Version="$(MicrosoftIdentityClientVersion)" />
+ <PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" />
  </ItemGroup>
 
  <ItemGroup Condition="'$(TargetFramework)' == 'net462' Or '$(TargetFramework)' == 'net6.0' Or '$(TargetFramework)' == 'net7.0' Or '$(TargetFramework)' == 'net8.0' Or '$(TargetFramework)' == 'net9.0'">

diff --git a/src/Microsoft.Identity.Web/Microsoft.Identity.Web.csproj b/src/Microsoft.Identity.Web/Microsoft.Identity.Web.csproj
@@ -18,10 +18,8 @@
  <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="$(IdentityModelVersion)" />
  <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="$(IdentityModelVersion)" />
  <PackageReference Include="Microsoft.Extensions.Http" Version="$(MicrosoftExtensionsHttpVersion)" />
- </ItemGroup>
-
- <ItemGroup Condition="'$(TargetFrameworkIdentifier)' != '.NETCoreApp'">
- <PackageReference Include="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebVersion)" />
+ <PackageReference Include="System.Text.Json" Version="$(SystemTextJsonVersion)" />
+ <PackageReference Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" />
  </ItemGroup>
 
  <ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETFramework' Or '$(TargetFramework)' == 'netstandard2.0'">

diff --git a/tests/DevApps/aspnet-mvc/OwinWebApi/Web.config b/tests/DevApps/aspnet-mvc/OwinWebApi/Web.config
@@ -34,11 +34,11 @@
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="System.Text.Json" publicKeyToken="CC7B13FFCD2DDD51" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-6.0.0.5" newVersion="6.0.0.5"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.4" newVersion="8.0.0.4"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="System.Text.Encodings.Web" publicKeyToken="CC7B13FFCD2DDD51" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="System.Security.Principal.Windows" publicKeyToken="B03F5F7F11D50A3A" culture="neutral"/>
@@ -62,7 +62,7 @@
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="System.IdentityModel.Tokens.Jwt" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-7.5.2.0" newVersion="7.5.2.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="System.Diagnostics.DiagnosticSource" publicKeyToken="CC7B13FFCD2DDD51" culture="neutral"/>
@@ -78,31 +78,31 @@
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.IdentityModel.Tokens" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-7.5.2.0" newVersion="7.5.2.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.IdentityModel.Protocols.WsFederation" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
  <bindingRedirect oldVersion="0.0.0.0-5.5.0.0" newVersion="5.5.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.IdentityModel.Protocols.OpenIdConnect" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-7.5.2.0" newVersion="7.5.2.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.IdentityModel.Protocols" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-7.5.2.0" newVersion="7.5.2.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.IdentityModel.Logging" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-7.5.2.0" newVersion="7.5.2.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.IdentityModel.Abstractions" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-7.5.2.0" newVersion="7.5.2.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.Identity.Client" publicKeyToken="0A613F4DD989E8AE" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-4.60.3.0" newVersion="4.60.3.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-4.61.3.0" newVersion="4.61.3.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.Extensions.Primitives" publicKeyToken="ADB9793829DDAE60" culture="neutral"/>
@@ -162,7 +162,7 @@
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.Bcl.AsyncInterfaces" publicKeyToken="CC7B13FFCD2DDD51" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.AspNetCore.Http.Features" publicKeyToken="ADB9793829DDAE60" culture="neutral"/>
@@ -189,4 +189,4 @@
  <compiler language="vb;vbs;visualbasic;vbscript" extension=".vb" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.VBCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=2.0.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" warningLevel="4" compilerOptions="/langversion:default /nowarn:41008 /define:_MYTYPE=\&quot;Web\&quot; /optionInfer+"/>
  </compilers>
  </system.codedom>
-</configuration>
+</configuration>
diff --git a/tests/DevApps/aspnet-mvc/OwinWebApp/Web.config b/tests/DevApps/aspnet-mvc/OwinWebApp/Web.config
@@ -25,21 +25,17 @@
  <assemblyIdentity name="WebGrease" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
  <bindingRedirect oldVersion="0.0.0.0-1.6.5135.21930" newVersion="1.6.5135.21930"/>
  </dependentAssembly>
- <dependentAssembly>
- <assemblyIdentity name="System.ValueTuple" publicKeyToken="CC7B13FFCD2DDD51" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-4.0.3.0" newVersion="4.0.3.0"/>
- </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="System.Threading.Tasks.Extensions" publicKeyToken="CC7B13FFCD2DDD51" culture="neutral"/>
  <bindingRedirect oldVersion="0.0.0.0-4.2.0.1" newVersion="4.2.0.1"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="System.Text.Json" publicKeyToken="CC7B13FFCD2DDD51" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-6.0.0.5" newVersion="6.0.0.5"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.4" newVersion="8.0.0.4"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="System.Text.Encodings.Web" publicKeyToken="CC7B13FFCD2DDD51" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="System.Security.Principal.Windows" publicKeyToken="B03F5F7F11D50A3A" culture="neutral"/>
@@ -63,7 +59,7 @@
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="System.IdentityModel.Tokens.Jwt" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-7.5.2.0" newVersion="7.5.2.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="System.Diagnostics.DiagnosticSource" publicKeyToken="CC7B13FFCD2DDD51" culture="neutral"/>
@@ -79,31 +75,31 @@
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.IdentityModel.Tokens" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-7.5.2.0" newVersion="7.5.2.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.IdentityModel.Protocols.WsFederation" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
  <bindingRedirect oldVersion="0.0.0.0-5.5.0.0" newVersion="5.5.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.IdentityModel.Protocols.OpenIdConnect" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-7.5.2.0" newVersion="7.5.2.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.IdentityModel.Protocols" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-7.5.2.0" newVersion="7.5.2.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.IdentityModel.Logging" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-7.5.2.0" newVersion="7.5.2.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.IdentityModel.Abstractions" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-7.5.2.0" newVersion="7.5.2.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.Identity.Client" publicKeyToken="0A613F4DD989E8AE" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-4.60.3.0" newVersion="4.60.3.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-4.61.3.0" newVersion="4.61.3.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.Extensions.Primitives" publicKeyToken="ADB9793829DDAE60" culture="neutral"/>
@@ -163,7 +159,7 @@
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Microsoft.Bcl.AsyncInterfaces" publicKeyToken="CC7B13FFCD2DDD51" culture="neutral"/>
- <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0"/>
+ <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/>
  </dependentAssembly>
  <dependentAssembly>
  <assemblyIdentity name="Azure.Core" publicKeyToken="92742159E12E44C8" culture="neutral"/>
@@ -173,7 +169,7 @@
  <assemblyIdentity name="Antlr3.Runtime" publicKeyToken="EB42632606E9261F" culture="neutral"/>
  <bindingRedirect oldVersion="0.0.0.0-3.5.0.2" newVersion="3.5.0.2"/>
  </dependentAssembly>
-
+  
  </assemblyBinding>
  </runtime>
  <system.codedom>
@@ -182,4 +178,4 @@
  <compiler language="vb;vbs;visualbasic;vbscript" extension=".vb" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.VBCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=2.0.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" warningLevel="4" compilerOptions="/langversion:default /nowarn:41008 /define:_MYTYPE=\&quot;Web\&quot; /optionInfer+"/>
  </compilers>
  </system.codedom>
-</configuration>
+</configuration>
diff --git a/tests/E2E Tests/NET 7 tests/IntegrationTests/IntegrationTests.csproj b/tests/E2E Tests/NET 7 tests/IntegrationTests/IntegrationTests.csproj
@@ -10,6 +10,7 @@
  <ItemGroup>
  <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="$(MicrosoftAspNetCoreMvcTestingVersion)" />
  <PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(MicrosoftNetTestSdkVersion)" />
+ <PackageReference Include="System.Text.Json" Version="$(SystemTextJsonVersion)" />
  <!--GHSA-5crp-9r3c-p9vr from Microsoft.NET.Test.Sdk -->
  <PackageReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" />
  <PackageReference Include="xunit" Version="$(XunitVersion)" />

diff --git a/tests/E2E Tests/WebAppUiTests/WebAppUiTests.csproj b/tests/E2E Tests/WebAppUiTests/WebAppUiTests.csproj
@@ -13,6 +13,7 @@
  <PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(MicrosoftNetTestSdkVersion)" />
  <PackageReference Include="Microsoft.Playwright" Version="$(MicrosoftPlaywrightVersion)" />
  <PackageReference Include="System.Management" Version="$(SystemManagementVersion)" />
+ <PackageReference Include="System.Text.Json" Version="$(SystemTextJsonVersion)" />
  <PackageReference Include="xunit" Version="$(XunitVersion)" />
  <PackageReference Include="xunit.runner.visualstudio" Version="$(XunitRunnerVisualStudioVersion)">
  <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

diff --git a/tests/Microsoft.Identity.Web.Test.Common/Microsoft.Identity.Web.Test.Common.csproj b/tests/Microsoft.Identity.Web.Test.Common/Microsoft.Identity.Web.Test.Common.csproj
@@ -16,6 +16,7 @@
  <PackageReference Include="Microsoft.Identity.Lab.Api" Version="$(MicrosoftIdentityLabApiVersion)" />
  <PackageReference Include="NSubstitute" Version="$(NSubstituteVersion)" />
  <PackageReference Include="xunit.assert" Version="$(XunitAssertVersion)" />
+ <PackageReference Include="System.Text.Json" Version="$(SystemTextJsonVersion)" />
  </ItemGroup>
 
  <ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETFramework'">

diff --git a/tests/Microsoft.Identity.Web.Test.Integration/Microsoft.Identity.Web.Test.Integration.csproj b/tests/Microsoft.Identity.Web.Test.Integration/Microsoft.Identity.Web.Test.Integration.csproj
@@ -28,6 +28,7 @@
  </PackageReference>
  <PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(MicrosoftNetTestSdkVersion)" />
  <PackageReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" />
+ <PackageReference Include="System.Text.Json" Version="$(SystemTextJsonVersion)" />
  </ItemGroup>
 
  <ItemGroup>

diff --git a/tests/Microsoft.Identity.Web.Test/Microsoft.Identity.Web.Test.csproj b/tests/Microsoft.Identity.Web.Test/Microsoft.Identity.Web.Test.csproj
@@ -19,6 +19,7 @@
  </ItemGroup>
 
  <ItemGroup>
+ <PackageReference Include="System.Text.Json" Version="$(SystemTextJsonVersion)" />
  <PackageReference Include="Microsoft.Identity.Abstractions" Version="$(MicrosoftIdentityAbstractions)" />
  <PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(MicrosoftNetTestSdkVersion)" />
  <PackageReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" />

diff --git a/...eTests/Microsoft.Identity.Web.Perf.Benchmark/Microsoft.Identity.Web.Perf.Benchmark.csproj b/...eTests/Microsoft.Identity.Web.Perf.Benchmark/Microsoft.Identity.Web.Perf.Benchmark.csproj
@@ -16,6 +16,7 @@
  <PackageReference Include="BenchmarkDotNet" Version="$(BenchmarkDotNetVersion)" />
  <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="$(MicrosoftAspNetCoreMvcTestingVersion)" />
  <PackageReference Include="Microsoft.Identity.Lab.Api" Version="$(MicrosoftIdentityLabApiVersion)" />
+ <PackageReference Include="System.Text.Json" Version="$(SystemTextJsonVersion)" />
  </ItemGroup>
 
  <ItemGroup>