Upgrade references to remove dependency on Newtonsoft

[ErikPilsits-RJW]

Consider updating the Microsoft.Extensions.Configuration.Json reference in Microsoft.ApplicationInsights.AspNetCore to at least version 3.0.0. Prior versions take a dependency on Newtonsoft.Json that may be undesirable.

[TimothyMothra]

Adding context....

The current version of our Microsoft.ApplicationInsights.AspNetCore has this dependency:

ApplicationInsights-dotnet/NETCORE/src/Microsoft.ApplicationInsights.AspNetCore/Microsoft.ApplicationInsights.AspNetCore.csproj

Line 37 in a232106

<PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="2.1.0" />

Microsoft.Extensions.Configuration.Json v2.1.0 was published 5/29/2018 and has a dependency on Newtonsoft.Json v11.0.2.
https://www.nuget.org/packages/Microsoft.Extensions.Configuration.Json/2.1.0

Can confirm, this dependency was removed in v3.0.0
https://www.nuget.org/packages/Microsoft.Extensions.Configuration.Json/3.0.0

[TimothyMothra]

As a workaround, you should be able to take a manual dependency on Microsoft.Extensions.Configuration.Json v3 which would override our implicit dependency.

[rmihael]

Newtonsoft.Json now has the High Severity CVE: GHSA-5crp-9r3c-p9vr
While it may be hard to exploit through Application Insights heyhole, it still triggers vulnerability scanners. It would be great to finally get rid of it.

[TimothyMothra]

Hello all, 2.21-beta3 was released today which contains this fix.