Is ASP.NET Core on .NET Framework still supported by Microsoft?

Question

I'd like to know if ASP.NET Core - specifically version 2.1 - is still supported if it is running on the .NET Framework runtime . With "supported" I only mean "is still getting security fixes" in the context of this question.

According to the .NET Core and .NET 5 Support Policy :

ASP.NET Core 2.1 on .NET Framework

Support for ASP.NET Core 2.1 on .NET Framework matches the ASP.NET Support policy for other package-based ASP.NET frameworks. The complete list of packages covered by this policy can be seen in ASP.NET Core 2.1 Supported Packages .

The first link ( ASP.NET Support ) says this:

[...] the following ASP.NET Core 2.1 (latest patched version only) packages will be supported on the .NET Framework and follow the support cycle for those .NET Framework versions.

Although there is no "following" list, I assume they mean the packages link. That page lists ASP.NET Core packages, eg the "main" package "Microsoft.AspNetCore".

So all of this seems to indicate that ASP.NET Core 2.1 on .NET Framework is still supported.

Question 1: Is this correct?

But the last released AspNetCore package is 2.1.7 from January 2019, whereas the current 2.1.x version of .NET Core is 2.1.24 from January 2021.

Question 2: Why are there no updates for the ASP.NET Core NuGet package for 2 years even though it should still be supported?

If it's still supported, doesn't this also mean that ASP.NET Core 2.1 on .NET Framework is supported as long as the .NET Framework itself is supported - which bascially means as long as the Windows version it's running on is supported? So even after .NET Core 2.1 support ends on August 21, 2021, ASP.NET Core 2.1 on .NET Framework should still get security updates, right?

Question 3: Is this correct, so will we basically get security updates "forever"?

Answer 1

"Supported" is not the same as "under active development"; it means that you might be able to get some help if there's a problem within what it is already intended to do - it doesn't mean that you get new features or APIs.

In reality, though; it would be highly inadvisable to start any new work on any version of .NET Core prior to 3.1 (at the time of writing), or to start any new projects on .NET Framework (any version), without first understanding exactly why you are doing that - both what you are gaining, and what you are sacrificing. All new work should (frankly) target .NET 3.1, or if you want "the new new", .NET 5 but bearing in mind that .NET 5 is not an LTS release, so this should just be a temporary target, with a view of moving to .NET 6 (which is LTS) when that is available.

Answer 2

I've got an answer from a Microsoft employee here .

TLDR: Yes, ASP.NET Core 2.1 on .NET Framework ist still supported and will be supported as long as the .NET Framework. The NuGet package didn't get any updates because they don't publish new packages for transitive reference updates.

Edit: Sadly Microsoft disabled the discussions on the linked repository, so the post is no longer available. But a recent blog post that highlighted the end of life of .NET Core 2.1 it was also mentioned that this doesn't affect ASP.NET Core 2.1 on .NET Framework:

Note: support for ASP.NET Core 2.1 on .NET Framework matches the support policy of the .NET Framework. See the ASP.NET Support Policy for more details

Answer 3

Let's understand first about which version of .NET Core you are talking about. Microsoft does not support any version whose updates and end of support date are announced.

Microsoft has its cadence and is been doing it from its inception to keep itself updated and provide new features, functionalities, and more security to its users. Microsoft's vision for the future of .NET Core is very clear and it will keep bringing regular updates on a regular interval to meet the demand of the future.

Microsoft cadence for .NET Core Versions release date and end of support date

To know about the supported version for ASP.NET Core by Microsoft, you can read more here: Microsoft announces end of .NET Core 2.1 support

Answer 4

The support page link in the question clearly explains those packages are maintained

To help facilitate migrating applications to ASP.NET Core on .NET Core.

The change is nothing new, it was announced during .NET Core 3's development and upon release, in articles, blog posts etc.

ASP.NET Core 2.1 on .NET Core 2.1 gets frequent updates because it follows .NET Core 2.1's support policy. .NET Core 2.1 and .NET Core 3.1 are long-term support versions, which means they're supported for 3 years after release. This is explained in the .NET Core Support Policy . BTW 2.1's support end on August 2021, so you'd better migrate to 3.1.

The real question should be Is .NET Old (Framework) still supported? . Only for security fixes. ASP.NET Core 3 and later come out only for .NET Core. .NET 5 is .NET Core 5.

It's time to upgrade

Where to get the Security Updates

Through Windows Update. Fixes and patches for .NET Framework are released through the .NET Framework Security and Quality Rollup updates.