Bump Newtonsoft.Json from 10.0.3 to 13.0.1 in /src/Authentication/Authentication.Core causes module version conflict

[rachelxj-ms]

created powershell 7 function app,
dependencies:
'Az.Accounts' = '2.9.1'
'Microsoft.Graph' = '1.11.0'
'Az.KeyVault' = '4.6.1'
'MSAL.PS' = '4.2.1.3'

$AppId = 'xxx'
$TenantId = 'xxx'
$ClientSecret = 'xxx'

Import-Module MSAL.PS
$MsalToken = Get-MsalToken -TenantId $TenantId -ClientId $AppId -ClientSecret ($ClientSecret | ConvertTo-SecureString -AsPlainText -Force)

Connect-MgGraph -AccessToken $MsalToken.AccessToken

Error Command Connect-MgGraph and error message Could not load file or assembly 'Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed'. The system cannot find the file specified.

PowerShell 7 currently ships with Newtonsoft.Json 12.0.3 according to this document: https://docs.microsoft.com/en-us/powershell/scripting/dev-cross-plat/resolving-dependency-conflicts?view=powershell-7.2

#1341, this change was released with 1.11.0, but when I tried to set 'Microsoft.Graph' = '1.10.0', it failed with same error, it still tries to load Microsoft.Graph.Authentication, Version=1.11.0.0. It's probably because 1.11.0 has been installed on the machine.
So I have to use 1.9.6 as a workaround. Please help fix this issue.

[2022-08-05T09:38:28.761Z] Exception :
[2022-08-05T09:38:28.763Z] Type : System.IO.FileNotFoundException
[2022-08-05T09:38:28.766Z] Message : Could not load file or assembly 'Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed'. The system cannot find the file specified.
[2022-08-05T09:38:28.768Z] FileName : Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed
[2022-08-05T09:38:28.771Z] TargetSite :
[2022-08-05T09:38:28.773Z] Name : MoveNext
[2022-08-05T09:38:28.775Z] DeclaringType : Microsoft.Graph.PowerShell.Authentication.Cmdlets.ConnectMgGraph+d__56, Microsoft.Graph.Authentication, Version=1.11.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35

[eric-duncan-pdx]

I'm also seeing this same error on an existing Azure Function running PowerShell Core v7.

[peombwa]

Thanks for following up on this.

The latest version of PowerShell, v7.2.5, uses Newtonsoft.Json v13.0.1, see PowerShell/PowerShell#15084. The bump to v13.0.1 is mandatory for all applications using Newtonsoft.Json due to the security vulnerability present in older versions of Newtonsoft.Json, see GHSA-5crp-9r3c-p9vr.

Please update your function app's PowerShell core version to PowerShell 7.2 - https://docs.microsoft.com/en-us/azure/azure-functions/functions-reference-powershell?tabs=portal#changing-the-powershell-version.

[zackoch]

Also saw this as well. Thank you - confirmed peombwa's explanation is accurate.
Good reminder to specify static versions for production workloads.

[rachelxj-ms]

@peombwa Thanks. It works.

[PaulFeaser]

Thank you, upgrading to PowerShell 7.2 solved this issue for me

[peombwa]

Closing the issue as resolved.

[FialaP]

Thanks for following up on this.

The latest version of PowerShell, v7.2.5, uses Newtonsoft.Json v13.0.1, see PowerShell/PowerShell#15084. The bump to v13.0.1 is mandatory for all applications using Newtonsoft.Json due to the security vulnerability present in older versions of Newtonsoft.Json, see GHSA-5crp-9r3c-p9vr.

Please update your function app's PowerShell core version to PowerShell 7.2 - https://docs.microsoft.com/en-us/azure/azure-functions/functions-reference-powershell?tabs=portal#changing-the-powershell-version.

Hello guys,
I have the same problem, but in a slightly different environment. I am using Connect-MgGraph in Azure Automation - PowerShell runbook, where only PowerShell runtime version 5.1 or 7.1 (preview) is available (using now 7.1 (preview)). I'm afraid that upgrading to PowerShell runtime version 7.2 is not possible there. Or how to do it?

I also tried to use Microsoft.Graph.Authentication version 1.9.6 as a workaround from powershellgallery, but I can't get this version for PowerShell 7.1 runtime version. When I get it into the runbook via the Azure Automation tab, the runbook cannot find this module probably because of the runtime version 5.1 listed in the runbook modules for that runbook. So second question is how can I get Microsoft.Graph.Authentication version 1.9.6 for Powershell 7.1 runtime version to Azure powershell runbook (workaround)?
Or is there any another workaround?

Thanks.
PF