the cosmos nuget package only specifies the minimum required version of newtonsoft. in you actual application that uses the cosmos db package, can explicitly use a later version of newtonsoft. if the newtonsoft is an implicit dependency, then just add a package reference to newtonsoft which is the version you want.
note: this is true of most nuget packages. they just specify a min version. in your build you specify the actual version. you might be interested in this approach to handling implicit dependencies.
https://learn.microsoft.com/en-us/nuget/consume-packages/central-package-management