CHANGELOG

src/OpenTelemetry.Instrumentation.AWSLambda/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## Unreleased
 
+* Add explicit dependency on Newtonsoft.Json, upgrading the minimum version.
+
+  This resolves a warning that some dependency analyzers may produce where this
+  package would transitively depend on a vulnerable version of Newtonsoft.Json
+  through [Amazon.Lambda.APIGatewayEvents][].
+
+  This also avoids a potential issue where the instrumentation would try to call
+  a Newtonsoft.Json function when no other package nor the app itself depends on
+  Newtonsoft.Json, since the transitive dependency would be ignored unless using
+  application were compiled against a TargetFramework older than Core 3.1.
+
+[Amazon.Lambda.APIGatewayEvents]: https://www.nuget.org/packages/Amazon.Lambda.APIGatewayEvents/2.4.1#dependencies-body-tab
+
 ## 1.1.0-beta.3
 
 Released 2023-Jun-13