Skip to content

[release/10.0] Fixing JsonPatchDocument bug #65736

Merged
wtgodbe merged 10 commits intorelease/10.0from
backport/pr-65470-to-release/10.0
Mar 11, 2026
Merged

[release/10.0] Fixing JsonPatchDocument bug #65736
wtgodbe merged 10 commits intorelease/10.0from
backport/pr-65470-to-release/10.0

Conversation

@github-actions
Copy link
Copy Markdown
Contributor

@github-actions github-actions bot commented Mar 10, 2026

Backport of #65470 to release/10.0

/cc @adityamandaleeka @HPOD00019

Fixing JsonPatchDocument bug with nested array property traversal

Fix JsonPatch operations on nested array element properties

Description

ListAdapter.TryTraverse casts the target to non-generic IList, but JsonArray only implements generic IList<JsonNode>. This causes all JSON Patch operations that traverse into array elements (e.g., /items/0/name) to fail with "target location not found" when applied to JsonNode/JsonObject targets. The fix aligns TryTraverse with the pattern already used by every other method in the class (TryAdd, TryGet, TryRemove, TryReplace, TryTest), using TryGetListTypeArgument and GenericListOrJsonArrayUtilities.

Fixes #65409

Customer Impact

Customer reported. JSON Patch operations cannot replace, add, remove, or access properties within array elements when applied to JsonNode/JsonObject instances. For example, a path like /items/0/name throws a JsonPatchException even though the path is valid per RFC 6902. There is no workaround. The customer is actively waiting for this fix in 10.0 servicing.

Regression?

  • Yes
  • No

This has been present since Microsoft.AspNetCore.JsonPatch.SystemTextJson shipped in 10.0.

Risk

  • High
  • Medium
  • Low

5 src lines changed in a single method (TryTraverse) to use the same utility methods already called by every other method in the same class. 155 test lines added across 8 new tests.

Verification

  • Manual (required)
  • Automated

Packaging changes reviewed?

  • Yes
  • No
  • N/A

When servicing release/2.3

  • Make necessary changes in eng/PatchConfig.props

HPOD00019 and others added 10 commits March 10, 2026 23:51
When a JsonArray was passed as the target parameter, it was being cast to IList, resulting in null. This happened because JsonArray only properly implements IList<JsonNode>, not the non-generic IList interface.
The fix adds a conditional check: if the object is IList<JsonNode> (like JsonArray), handle it properly instead of returning null. So now method returns actual array value rather than null.
All types that implements IList are handled as before. Types that implement IList<JsonNode> now correctly return the array value
When a JsonArray was passed as the target parameter, it was being cast to IList, resulting in null. This happened because JsonArray only properly implements IList<JsonNode>, not the non-generic IList interface.

The fix adds a conditional check: if the object is IList<JsonNode> (like JsonArray), handle it properly instead of returning null. So now method returns actual array value rather than null.

All types that implements IList are handled as before. Types that implement IList<JsonNode> now correctly return the array value
@github-actions github-actions bot added the area-mvc Includes: MVC, Actions and Controllers, Localization, CORS, most templates label Mar 10, 2026
@wtgodbe wtgodbe added the Servicing-approved Shiproom has approved the issue label Mar 11, 2026
@wtgodbe
Copy link
Copy Markdown
Member

wtgodbe commented Mar 11, 2026

Approved over email

@wtgodbe wtgodbe merged commit 73c3f25 into release/10.0 Mar 11, 2026
28 checks passed
@wtgodbe wtgodbe deleted the backport/pr-65470-to-release/10.0 branch March 11, 2026 01:35
@dotnet-policy-service dotnet-policy-service bot added this to the 10.0.5 milestone Mar 11, 2026
@wtgodbe wtgodbe modified the milestones: 10.0.5, 10.0.6 Mar 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area-mvc Includes: MVC, Actions and Controllers, Localization, CORS, most templates Servicing-approved Shiproom has approved the issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants