JsonPatch System.Text.Json - based .NET 10 Preview 4 update

[wadepickett]

Fixes #35237
Fixes #35435

• Follows the detailed guidance provided in New JsonPatch documentation page for System.Text.Json-based JsonPatch implementation #35237 by @mkArtakMSFT.
• Add security mentions in the .NET 9 version of this topic.
• Mention the new System.Text.Json based version in the .NET 9 version of this topic and point to the new one to help alleviate confusion between the two.
• Update the app sample with the new code snippets and verify.
• Dynamic objects are not supported. Clarify that and remove dynamic object examples.
• Update any .NET/library API references with xref links

Table of changes with summaries:

Change Type	Description	Line Numbers (approximate)
Security warning (IMPORTANT)	Added warning about security risks	5–7, 301–304
Mitigating security risks section	Added detailed attack/mitigation section	242–288, 534–580
Remove dynamic object example	Removed 'Dynamic objects' section and example code	150–155 (in old orginal)
Remove dynamic-specific bullets	Removed dynamic/static object distinctions under add, remove, move ops	161–162, 172–175, 195 (in old original)
System.Text.Json clarification	Clarified lack of support, proper formatter setup	22–37 (edit)
Reorg/clarity of install steps	Improved doc structure for package install/configuration	7–13 (edit)

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/web-api/jsonpatch.md	aspnetcore/web-api/jsonpatch

[wadepickett]

@mkArtakMSFT, could use your review. Is there a different alias I should use that is recognized by github for internal review? The one you used to create the issue does not seem to work.

[wadepickett]

@guardrex, just CC for awareness in case you want to review, but not required.

[guardrex]

My only concern was the pass on the .NET 10 What's New guidance when the community member opened an issue about the package reference ...

https://github.com/dotnet/AspNetCore.Docs/pull/35610/files

So far, nothing is broken here. 🤞🍀

[wadepickett]

My only concern was the pass on the .NET 10 What's New guidance when the community member opened an issue about the package reference ...

https://github.com/dotnet/AspNetCore.Docs/pull/35610/files

So far, nothing is broken here. 🤞🍀

I missed that occurred, thanks. Ther was no issue tied to it and I wasn't on the loop. I didn't see it in time on the PR list. Looking it over now...

[wadepickett]

I point to the correct one here:
" JSON Patch support with System.Text.Json, install the Microsoft.AspNetCore.JsonPatch.SystemTextJson

However, that is with the installation instructions. I'll mention it at the very top too as we did before, but of course to the new package.

[wadepickett]

Actually, I DID persist that issue. Fixing it now. Thanks @guardrex!
It was
https://www.nuget.org/packages/Microsoft.AspNetCore.JsonPatch
fixing and changing to:
https://www.nuget.org/packages/Microsoft.AspNetCore.JsonPatch.SystemTextJson

Plus adding the mention at the top.

[mikekistler]

Here's a first round of comments. Perhaps you can address these while I put together an updated example app.

[mikekistler]

Here's a sample project that illustrates the new JSON Patch support in both a controller-based and Minimal APIs app (actually it is one app with both controllers and minimal API endpoints).

https://github.com/mikekistler/aspnet-json-patch/tree/main

[mikekistler]

I think we also want at least a brief description of JSON Patch support in the Minimal APIs section of the doc.

[wadepickett]

Here's a sample project that illustrates the new JSON Patch support in both a controller-based and Minimal APIs app (actually it is one app with both controllers and minimal API endpoints).

https://github.com/mikekistler/aspnet-json-patch/tree/main
Excellent, thanks @mikekistler!
Can I put a copy of your example app here with the content or do you mean to just use it as a general guideline? Or is the sample moving an MS owned repo and we link to it?

[mikekistler]

Can I put a copy of your example app here with the content

Yes ... I think it should replace the current sample in aspnetcore/web-api/jsonpatch/samples/10.x/api

[tdykstra]

Nice work! I left a few comments and suggestions.

[wadepickett]

Set back to draft.
Added mikes app sample to samples/10.x/
Updated controller action method section to address the new code examples.

Next:
Add Minimal API equivalent to action method section for Min API.
Updating section: Apply a JSON Patch document to an object to use the newer app sample.

[mikekistler]

I think there is more we want to do to document JsonPatch, like adding something into the Minimal APIs section of the docs, but what's here seems complete and accurate for controllers (modulo the one comment I left on fixing the refs) and I don't think we should wait to merge this, so approving.