Bump System.Text.Json version due to CVE-2024-30105

[rajkumar-rangaraj]

Discussion for this issue can be found at dotnet/runtime#104619

• The test and example project references for System.Text.Json have been updated.
• The Console and Zipkin exporters use a safe version (4.7.2) of System.Text.Json, so no update is needed there.

Merge requirement checklist

• CONTRIBUTING guidelines followed (license requirements, nullable enabled, static analysis, etc.)
• Unit tests added/updated
• Appropriate CHANGELOG.md files updated for non-trivial changes
• Changes in public API reviewed (if applicable)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 86.19%. Comparing base (6250307) to head (f203db7).
Report is 278 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5744      +/-   ##
==========================================
+ Coverage   83.38%   86.19%   +2.81%     
==========================================
  Files         297      254      -43     
  Lines       12531    11057    -1474     
==========================================
- Hits        10449     9531     -918     
+ Misses       2082     1526     -556     

Flag	Coverage Δ
unittests	?
unittests-Project-Experimental	86.12% <ø> (?)
unittests-Project-Stable	86.19% <ø> (?)
unittests-Solution	86.17% <ø> (?)
unittests-UnstableCoreLibraries-Experimental	85.86% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

see 197 files with indirect coverage changes

[cremor]

FYI: dotnet/runtime#104619 (comment)
Meaning: Maybe the version you are currently using isn't even vulnerable.

[rajkumar-rangaraj]

FYI: dotnet/runtime#104619 (comment) Meaning: Maybe the version you are currently using isn't even vulnerable.

Thanks @cremor 4.7.2 version is not vulnerable. I will change this PR to update the test and examples package.

[rajkumar-rangaraj]

CI is reporting the below errors, but 4.7.2 is not vulnerable.

[cijothomas]

@alanwest Could you help merge this? Blanch is on vacation, and this is pre-req to unblock any other PRs.

[cijothomas]

@alanwest Could you help merge this? Blanch is on vacation, and this is pre-req to unblock any other PRs.

Looks like Alan is also on vacation, so need someone from TC to merge. @reyang can you help?

[alanwest]

I am out today, but could be available to merge this. Will be near a computer soonish. I see build failed though...

[cijothomas]

I am out today, but could be available to merge this. Will be near a computer soonish. I see build failed though...

Prior failure was due to nuget/ci bug that incorrectly detected 4.7.2 as vulnerable. I re-triggerred CI, hopefully it should pass!

[cijothomas]

CI is green now :)