System.Text.Json 8.0

Apply these System.Text.Json 8.0 rules after the C# 12 baseline. Treat deserialization as construction from hostile data, even when the serializer accepts the payload without error.

Version and options baseline

• Keep both places System.Text.Json comes from patched: the copy in the .NET 8 shared runtime, which each runtime servicing update replaces and NuGet audit never sees, and any standalone System.Text.Json 8.x package reference, which ships on its own schedule and is the copy the audit reports. Rebuild self-contained deployments after runtime updates.
• Build one explicit JsonSerializerOptions instance per trust contract, finish its converters and resolver chain during startup, call MakeReadOnly(), and never let request data choose or mutate that configuration.
• Prefer source-generated JsonSerializerContext metadata for the exact DTO set. Set JsonSerializerIsReflectionEnabledByDefault to false where reflection fallback would silently serialize an unregistered runtime type.
• Do not assume framework options equal new JsonSerializerOptions(): JsonSerializerDefaults.Web and ASP.NET Core use camel-case names, case-insensitive matching, and JsonNumberHandling.AllowReadingFromString.

Closed input contracts

• Deserialize external messages into dedicated DTOs, never domain entities, authorization objects, or types whose constructors, setters, callbacks, or collection contents carry authority or side effects.
• For closed messages, set UnmappedMemberHandling = JsonUnmappedMemberHandling.Disallow or use