[C#] source STJ from framework

[thompson-tomo]

What feature or improvement would you like to see?

I want System.Text.Json to only be an explicit dependency on net standard.

Use case

I want to minimise dependencies in my project by utilising framework dependencies wherever possible

Affected projects

• Apache.Arrow.Adbc
• Apache.Arrow.Adbc.Drivers.BigQuery
• Apache.Arrow.Adbc.Drivers.FlightSql

[CurtHagenlocher]

I don't think the disadvantages of using two different versions for two different targets are outweighed by the small advantages of not shipping a ~600KB assembly (and possibly being able to skip JIT for a project which isn't using ReadyToRun or AOT). What would happen if we wanted to use a newer feature that was in the .NET 10 implementation while we still support a .NET 8 target? Would someone then complain it was a breaking change if we went back to needing the dependency?

[thompson-tomo]

I don't think the disadvantages of using two different versions for two different targets are outweighed by the small advantages of not shipping a ~600KB assembly (and possibly being able to skip JIT for a project which isn't using ReadyToRun or AOT).

The advantages are not so much about the shipping size but more so about CVE mitigation, reducing chance of conflicts in version resolution which has occurred in a number of projects hence it is best if you can rely on the framework version to do that. Which is what I am proposing.

What would happen if we wanted to use a newer feature that was in the .NET 10 implementation while we still support a .NET 8 target? Would someone then complain it was a breaking change if we went back to needing the dependency?

Add the explicit STJ dependency for net 8 but not the net 10 when it is available and no not breaking change to force a package update from that available as part of the framework