#8811: Update vulnerable NuGet packages and consolidate them (#8812)

* Updating System.IdentityModel.Tokens.Jwt and its dependencies in Orchard.Azure.MediaServices * Using System.IO.Compression instead of DotNetZip * Upgrading Newtonsoft.Json from 12.0.3 (vulnerable) to 13.0.3 * Updating ModuleRootWebConfig.txt codegen template according to the new Newtonsoft.Json version
OrchardCMS · Dec 6, 2024 · 8425b4a · 8425b4a
1 parent 81570fa
commit 8425b4a
Show file tree

Hide file tree

Showing 122 changed files with 203 additions and 216 deletions.
diff --git a/CREDITS.txt b/CREDITS.txt
@@ -52,12 +52,6 @@ Website:      http://dlr.codeplex.com
 Copyright:    Copyright (c) Microsoft Corporation
 License:      Apache Software Foundation License 2.0
 
-DotNetZip
------
-Website:      http://dotnetzip.codeplex.com/
-Copyright:    
-License:      MS-PL
-
 Eric Meyer's Reset CSS
 -----
 Website:      http://meyerweb.com/eric/tools/css/reset/

diff --git a/src/Orchard.Core.Tests/App.config b/src/Orchard.Core.Tests/App.config
@@ -16,7 +16,7 @@
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-        <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+        <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="System.Web.Http" publicKeyToken="31bf3856ad364e35" culture="neutral" />

diff --git a/src/Orchard.Specs/App.Config b/src/Orchard.Specs/App.Config
@@ -24,7 +24,7 @@
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-        <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+        <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="System.Web.Http" publicKeyToken="31bf3856ad364e35" culture="neutral" />

diff --git a/src/Orchard.Tests.Modules/App.config b/src/Orchard.Tests.Modules/App.config
@@ -24,7 +24,7 @@
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" />
-        <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+        <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="Autofac" publicKeyToken="17863af14b0044da" />

diff --git a/src/Orchard.Tests.Modules/Media/Services/MediaServiceTests.cs b/src/Orchard.Tests.Modules/Media/Services/MediaServiceTests.cs
@@ -1,8 +1,8 @@
 using System;
 using System.Collections.Generic;
 using System.IO;
+using System.IO.Compression;
 using System.Linq;
-using Ionic.Zip;
 using NUnit.Framework;
 using Orchard.Environment.Configuration;
 using Orchard.FileSystems.Media;
@@ -53,10 +53,10 @@ public void GetPublicUrlTests() {
         [Test]
         public void GetMediaFoldersTest() {
             StorageProvider.ListFoldersPredicate = path => {
-                return string.IsNullOrEmpty(path) ? new[] {new StubStorageFolder(FolderName1)}
-                            : string.Equals(path, FolderName1) ? new[] {new StubStorageFolder(FolderName2), new StubStorageFolder(FolderName3)}
+                return string.IsNullOrEmpty(path) ? new[] { new StubStorageFolder(FolderName1) }
+                            : string.Equals(path, FolderName1) ? new[] { new StubStorageFolder(FolderName2), new StubStorageFolder(FolderName3) }
                                  : new StubStorageFolder[] { };
-                };
+            };
 
             IEnumerable<MediaFolder> mediaFolders = MediaService.GetMediaFolders(null);
             Assert.That(mediaFolders.Count(), Is.EqualTo(1), "Root path only has 1 sub directory");
@@ -94,7 +94,7 @@ public void UnzipMediaFileArchiveAdministratorTest() {
             Assert.That(StorageProvider.SavedStreams.Contains(StorageProvider.Combine(FolderName1, FinalDottedWebconfigFileName)), Is.False, "no extension files are never allowed");
             Assert.That(StorageProvider.SavedStreams.Contains(StorageProvider.Combine(FolderName1, PaddedWebconfigFileName)), Is.False, "no extension files are never allowed");
             Assert.That(StorageProvider.SavedStreams.Contains(StorageProvider.Combine(FolderName1, FinalDottedTextFileName)), Is.False, "no extension files are never allowed");
-            
+
             Assert.That(StorageProvider.SavedStreams.Count, Is.EqualTo(3));
         }
 
@@ -160,29 +160,30 @@ public void WebConfigIsBlackListed() {
         }
 
         private MemoryStream CreateZipMemoryStream() {
+            var entries = new List<string> {
+                TextFileName, WebconfigFileName, DllFileName, ZipFileName, NoExtensionFileName, PaddedWebconfigFileName,
+                FinalDottedWebconfigFileName, PaddedTextFileName, FinalDottedTextFileName
+            };
+
             // Setup memory stream with zip archive for more complex scenarios
             MemoryStream memoryStream = new MemoryStream();
-            using (ZipFile zipOut = new ZipFile()) {
-
-                zipOut.AddEntry(TextFileName, new byte[] { 0x01 });
-                zipOut.AddEntry(WebconfigFileName, new byte[] { 0x02 });
-                zipOut.AddEntry(DllFileName, new byte[] { 0x03 });
-                zipOut.AddEntry(ZipFileName, new byte[] { 0x04 });
-                zipOut.AddEntry(NoExtensionFileName, new byte[] { 0x05 });
-                zipOut.AddEntry(PaddedWebconfigFileName, new byte[] { 0x06 });
-                zipOut.AddEntry(FinalDottedWebconfigFileName, new byte[] { 0x07 });
-                zipOut.AddEntry(PaddedTextFileName, new byte[] { 0x08 });
-                zipOut.AddEntry(FinalDottedTextFileName, new byte[] { 0x09 });
-
-                zipOut.Save(memoryStream);
+            using (var archive = new ZipArchive(memoryStream, ZipArchiveMode.Create, leaveOpen: true)) {
+                var content = new byte[] { 0x01 };
+                foreach (var entry in entries) {
+                    var zipEntry = archive.CreateEntry(entry);
+                    using (var zipStream = zipEntry.Open()) {
+                        zipStream.Write(content, 0, 1);
+                    }
+                    ++content[0];
+                }
             }
-                
+
             return new MemoryStream(memoryStream.ToArray());
         }
 
         private class MediaServiceAccessor : MediaService {
             public MediaServiceAccessor(IStorageProvider storageProvider, IOrchardServices orchardServices)
-                : base (storageProvider, orchardServices) {}
+                : base(storageProvider, orchardServices) { }
 
             public void UnzipMediaFileArchiveAccessor(string targetFolder, Stream zipStream) {
                 UnzipMediaFileArchive(targetFolder, zipStream);

diff --git a/src/Orchard.Tests.Modules/Orchard.Tests.Modules.csproj b/src/Orchard.Tests.Modules/Orchard.Tests.Modules.csproj
@@ -64,9 +64,6 @@
     <Reference Include="Castle.Core, Version=3.3.0.0, Culture=neutral, PublicKeyToken=407dd0808d44fbdc, processorArchitecture=MSIL">
       <HintPath>..\packages\Castle.Core.3.3.1\lib\net45\Castle.Core.dll</HintPath>
     </Reference>
-    <Reference Include="DotNetZip, Version=1.12.0.0, Culture=neutral, PublicKeyToken=6583c7c814667745, processorArchitecture=MSIL">
-      <HintPath>..\packages\DotNetZip.1.12.0\lib\net20\DotNetZip.dll</HintPath>
-    </Reference>
     <Reference Include="FluentNHibernate, Version=2.0.3.0, Culture=neutral, processorArchitecture=MSIL">
       <HintPath>..\packages\FluentNHibernate.2.0.3.0\lib\net40\FluentNHibernate.dll</HintPath>
     </Reference>
@@ -107,8 +104,8 @@
     <Reference Include="Moq, Version=4.2.1510.2205, Culture=neutral, PublicKeyToken=69f491c39445e920, processorArchitecture=MSIL">
       <HintPath>..\packages\Moq.4.2.1510.2205\lib\net40\Moq.dll</HintPath>
     </Reference>
-    <Reference Include="Newtonsoft.Json, Version=12.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
-      <HintPath>..\packages\Newtonsoft.Json.12.0.3\lib\net45\Newtonsoft.Json.dll</HintPath>
+    <Reference Include="Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
+      <HintPath>..\packages\Newtonsoft.Json.13.0.3\lib\net45\Newtonsoft.Json.dll</HintPath>
     </Reference>
     <Reference Include="NHibernate, Version=4.1.0.4000, Culture=neutral, PublicKeyToken=aa95f207798dfdb4, processorArchitecture=MSIL">
       <HintPath>..\packages\NHibernate.4.1.2.4000\lib\net40\NHibernate.dll</HintPath>
@@ -134,6 +131,7 @@
       <HintPath>..\..\lib\sqlce\System.Data.SqlServerCe.dll</HintPath>
       <Private>True</Private>
     </Reference>
+    <Reference Include="System.IO.Compression" />
     <Reference Include="System.Web" />
     <Reference Include="System.Web.Abstractions">
       <RequiredTargetFramework>3.5</RequiredTargetFramework>

diff --git a/src/Orchard.Tests.Modules/packages.config b/src/Orchard.Tests.Modules/packages.config
@@ -2,7 +2,6 @@
 <packages>
   <package id="Autofac" version="3.5.2" targetFramework="net48" />
   <package id="Castle.Core" version="3.3.1" targetFramework="net48" />
-  <package id="DotNetZip" version="1.12.0" targetFramework="net48" />
   <package id="FluentNHibernate" version="2.0.3.0" targetFramework="net48" />
   <package id="Iesi.Collections" version="4.0.1.4000" targetFramework="net48" />
   <package id="IronRuby" version="1.1.3" targetFramework="net48" />
@@ -12,7 +11,7 @@
   <package id="Microsoft.AspNet.WebPages" version="3.2.7" targetFramework="net48" />
   <package id="Microsoft.Web.Infrastructure" version="1.0.0.0" targetFramework="net48" />
   <package id="Moq" version="4.2.1510.2205" targetFramework="net48" />
-  <package id="Newtonsoft.Json" version="12.0.3" targetFramework="net48" />
+  <package id="Newtonsoft.Json" version="13.0.3" targetFramework="net48" />
   <package id="NHibernate" version="4.1.2.4000" targetFramework="net48" />
   <package id="NUnit" version="2.5.10.11092" targetFramework="net48" />
   <package id="Orchard.FluentPath" version="1.0.0.1" targetFramework="net48" />

diff --git a/src/Orchard.Tests/App.config b/src/Orchard.Tests/App.config
@@ -24,7 +24,7 @@
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" />
-        <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+        <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="Autofac" publicKeyToken="17863af14b0044da" />

diff --git a/src/Orchard.Tests/Orchard.Framework.Tests.csproj b/src/Orchard.Tests/Orchard.Framework.Tests.csproj
@@ -104,8 +104,8 @@
     <Reference Include="Moq, Version=4.2.1510.2205, Culture=neutral, PublicKeyToken=69f491c39445e920, processorArchitecture=MSIL">
       <HintPath>..\packages\Moq.4.2.1510.2205\lib\net40\Moq.dll</HintPath>
     </Reference>
-    <Reference Include="Newtonsoft.Json, Version=12.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
-      <HintPath>..\packages\Newtonsoft.Json.12.0.3\lib\net45\Newtonsoft.Json.dll</HintPath>
+    <Reference Include="Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
+      <HintPath>..\packages\Newtonsoft.Json.13.0.3\lib\net45\Newtonsoft.Json.dll</HintPath>
     </Reference>
     <Reference Include="NHibernate, Version=4.1.0.4000, Culture=neutral, PublicKeyToken=aa95f207798dfdb4, processorArchitecture=MSIL">
       <HintPath>..\packages\NHibernate.4.1.2.4000\lib\net40\NHibernate.dll</HintPath>

diff --git a/src/Orchard.Tests/packages.config b/src/Orchard.Tests/packages.config
@@ -14,7 +14,7 @@
   <package id="Microsoft.AspNet.WebPages" version="3.2.7" targetFramework="net48" />
   <package id="Microsoft.Web.Infrastructure" version="1.0.0.0" targetFramework="net48" />
   <package id="Moq" version="4.2.1510.2205" targetFramework="net48" />
-  <package id="Newtonsoft.Json" version="12.0.3" targetFramework="net48" />
+  <package id="Newtonsoft.Json" version="13.0.3" targetFramework="net48" />
   <package id="NHibernate" version="4.1.2.4000" targetFramework="net48" />
   <package id="NUnit" version="2.5.10.11092" targetFramework="net48" />
   <package id="NUnitTestAdapter" version="2.3.0" targetFramework="net48" />

diff --git a/src/Orchard.Web.Tests/app.config b/src/Orchard.Web.Tests/app.config
@@ -16,7 +16,7 @@
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-        <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+        <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="System.Web.Http" publicKeyToken="31bf3856ad364e35" culture="neutral" />

diff --git a/src/Orchard.Web/Core/Web.config b/src/Orchard.Web/Core/Web.config
@@ -54,7 +54,7 @@
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-                       <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+                       <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />

diff --git a/src/Orchard.Web/Modules/Lucene/Web.config b/src/Orchard.Web/Modules/Lucene/Web.config
@@ -53,7 +53,7 @@
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-                       <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+                       <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />

diff --git a/src/Orchard.Web/Modules/Markdown/Web.config b/src/Orchard.Web/Modules/Markdown/Web.config
@@ -54,7 +54,7 @@
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-                       <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+                       <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />

diff --git a/src/Orchard.Web/Modules/Orchard.Alias/Web.config b/src/Orchard.Web/Modules/Orchard.Alias/Web.config
@@ -54,7 +54,7 @@
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-                       <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+                       <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />

diff --git a/src/Orchard.Web/Modules/Orchard.AntiSpam/Orchard.AntiSpam.csproj b/src/Orchard.Web/Modules/Orchard.AntiSpam/Orchard.AntiSpam.csproj
@@ -59,8 +59,8 @@
     <Reference Include="Microsoft.Web.Infrastructure, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
       <HintPath>..\..\..\packages\Microsoft.Web.Infrastructure.1.0.0.0\lib\net40\Microsoft.Web.Infrastructure.dll</HintPath>
     </Reference>
-    <Reference Include="Newtonsoft.Json, Version=12.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
-      <HintPath>..\..\..\packages\Newtonsoft.Json.12.0.3\lib\net45\Newtonsoft.Json.dll</HintPath>
+    <Reference Include="Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
+      <HintPath>..\..\..\packages\Newtonsoft.Json.13.0.3\lib\net45\Newtonsoft.Json.dll</HintPath>
     </Reference>
     <Reference Include="System" />
     <Reference Include="System.Data" />
@@ -250,4 +250,4 @@
       </FlavorProperties>
     </VisualStudio>
   </ProjectExtensions>
-</Project>
+</Project>
diff --git a/src/Orchard.Web/Modules/Orchard.AntiSpam/Web.config b/src/Orchard.Web/Modules/Orchard.AntiSpam/Web.config
@@ -54,7 +54,7 @@
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-                       <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+                       <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />

diff --git a/src/Orchard.Web/Modules/Orchard.AntiSpam/packages.config b/src/Orchard.Web/Modules/Orchard.AntiSpam/packages.config
@@ -5,5 +5,5 @@
   <package id="Microsoft.AspNet.WebPages" version="3.2.7" targetFramework="net48" />
   <package id="Microsoft.CodeDom.Providers.DotNetCompilerPlatform" version="4.1.0" targetFramework="net48" />
   <package id="Microsoft.Web.Infrastructure" version="1.0.0.0" targetFramework="net48" />
-  <package id="Newtonsoft.Json" version="12.0.3" targetFramework="net48" />
-</packages>
+  <package id="Newtonsoft.Json" version="13.0.3" targetFramework="net48" />
+</packages>
diff --git a/src/Orchard.Web/Modules/Orchard.ArchiveLater/Web.config b/src/Orchard.Web/Modules/Orchard.ArchiveLater/Web.config
@@ -54,7 +54,7 @@
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-                       <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+                       <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />

diff --git a/src/Orchard.Web/Modules/Orchard.AuditTrail/Orchard.AuditTrail.csproj b/src/Orchard.Web/Modules/Orchard.AuditTrail/Orchard.AuditTrail.csproj
@@ -61,8 +61,8 @@
     <Reference Include="Microsoft.Web.Infrastructure, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
       <HintPath>..\..\..\packages\Microsoft.Web.Infrastructure.1.0.0.0\lib\net40\Microsoft.Web.Infrastructure.dll</HintPath>
     </Reference>
-    <Reference Include="Newtonsoft.Json, Version=12.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
-      <HintPath>..\..\..\packages\Newtonsoft.Json.12.0.3\lib\net45\Newtonsoft.Json.dll</HintPath>
+    <Reference Include="Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
+      <HintPath>..\..\..\packages\Newtonsoft.Json.13.0.3\lib\net45\Newtonsoft.Json.dll</HintPath>
     </Reference>
     <Reference Include="NHibernate, Version=4.1.0.4000, Culture=neutral, PublicKeyToken=aa95f207798dfdb4, processorArchitecture=MSIL">
       <HintPath>..\..\..\packages\NHibernate.4.1.2.4000\lib\net40\NHibernate.dll</HintPath>

diff --git a/src/Orchard.Web/Modules/Orchard.AuditTrail/Web.config b/src/Orchard.Web/Modules/Orchard.AuditTrail/Web.config
@@ -56,7 +56,7 @@
             </dependentAssembly>
             <dependentAssembly>
                  <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-                 <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+                 <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
             </dependentAssembly>
             <dependentAssembly>
                  <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />

diff --git a/src/Orchard.Web/Modules/Orchard.AuditTrail/packages.config b/src/Orchard.Web/Modules/Orchard.AuditTrail/packages.config
@@ -6,7 +6,7 @@
   <package id="Microsoft.AspNet.WebPages" version="3.2.7" targetFramework="net48" />
   <package id="Microsoft.CodeDom.Providers.DotNetCompilerPlatform" version="4.1.0" targetFramework="net48" />
   <package id="Microsoft.Web.Infrastructure" version="1.0.0.0" targetFramework="net48" />
-  <package id="Newtonsoft.Json" version="12.0.3" targetFramework="net48" />
+  <package id="Newtonsoft.Json" version="13.0.3" targetFramework="net48" />
   <package id="NHibernate" version="4.1.2.4000" targetFramework="net48" />
   <package id="XMLDiffPatch" version="1.0.8.28" targetFramework="net48" />
-</packages>
+</packages>
diff --git a/src/Orchard.Web/Modules/Orchard.Autoroute/Web.config b/src/Orchard.Web/Modules/Orchard.Autoroute/Web.config
@@ -53,7 +53,7 @@
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />
-                       <bindingRedirect oldVersion="0.0.0.0-12.0.0.0" newVersion="12.0.0.0" />
+                       <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
                 </dependentAssembly>
                 <dependentAssembly>
                        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />