ASP.NET Core 2.1 becomes ASP.NET Core 2.3

terrajobst commented 1 month ago

We'll be reshipping ASP.NET Core 2.1 as ASP.NET Core 2.3 and encourage ASP.NET Core 2.2 users to update to it. In this post I'll provide more background.

[!NOTE]

This post only applies if you're using ASP.NET Core on .NET Framework. If you're using ASP.NET Core 2.x on .NET Core 2.x, it is already out of support, and you should upgrade to a supported version such as .NET 8.

Background

Early versions of ASP.NET Core were provided for .NET Framework and .NET Core. Since 2021, ASP.NET Core 2.1 is supported only when running on .NET Framework. ASP.NET Core 2.2 has been out of support on all platforms since 2019.

This happened before we had a predictable schedule and alternate releases of Standard Term Support (STS) and Long Term Support (LTS). Many users upgraded to ASP.NET Core 2.2, not realizing that this reduced their support duration.

As a result, we now have users that are running on the unsupported version of ASP.NET Core 2.2 on .NET Framework.

Product	.NET Framework Support
ASP.NET Core 2.1	Supported
ASP.NET Core 2.2	Ended December 23, 2019

How to stay supported

If you're on .NET Core, you should upgrade to .NET 8 and use ASP.NET Core 8
If you're on .NET Framework, you can either migrate to .NET 8 or upgrade to ASP.NET Core 2.3, which is the same code as ASP.NET Core 2.1 (see below)

Since ASP.NET Core 2.x for .NET Framework is just a set of packages, downgrading isn't that easy; there are well over one hundred packages and not all of them have 2.x version numbers. To make matters worse, there are NuGet packages out there that also upgraded to ASP.NET Core 2.2. Downgrading to ASP.NET Core 2.1 would mean that NuGet fails to restore these dependencies with errors.

In order to make this easier, we'll reship ASP.NET Core 2.1 as ASP.NET Core 2.3, thus facilitating this downgrade as a package upgrade.

You might wonder why we don't reship ASP.NET Core 2.2 as 2.3 instead. The answer is breaking changes. ASP.NET Core 2.2 went out of support five years ago, while ASP.NET Core 2.1 kept being supported. We feel it would be wrong to force ASP.NET Core 2.1 users to accommodate those breaking changes in order to stay supported.

Users on ASP.NET Core 2.2 are unsupported and won't receive any security updates. Our priority is to help those users to get onto a supported version of ASP.NET Core for .NET Framework.

By reshipping ASP.NET Core 2.1 as ASP.NET Core 2.3, we provide users on ASP.NET Core 2.2 an off ramp to the supported version via a regular NuGet upgrade. Users on ASP.NET Core 2.1 will also be pulled forward to 2.3, but since it's the same code as 2.1, there are no breaking changes. Moving forward, all updates to ASP.NET Core 2.1 will be published as 2.3. However, if you're using ASP.NET Core 2.1, you don't need to move to 2.3 in order to get updates. If we find security issues with 2.1 packages, those will be marked as vulnerable and the recommended version will be versioned as 2.3. Except for the version number changes, that's how ASP.NET Core 2.1 works today, so there are no changes for you and you don't need to preemptively update to ASP.NET Core 2.3 to receive those warnings.

[!CAUTION]

Please note that if you're using ASP.NET Core 2.2, you will not be getting vulnerability warnings via NuGet because the product is out of support. There is no change here, this has been the case since ASP.NET Core 2.2 went out of support five years ago. Therefore, if you're on ASP.NET Core 2.2, we strongly recommend to update to ASP.NET Core 2.3 as soon as possible in order to receive security fixes again.

We understand that this can be confusing, but we believe it's the best compromise to help ASP.NET Core 2.2 users to get back onto a supported train.

Product	.NET Framework Support
ASP.NET Core 2.1	Supported with ASP.NET Core 2.3
ASP.NET Core 2.2	Ended December 23, 2019
ASP.NET Core 2.3	Supported, same code as 2.1

Summary

For .NET Core, ASP.NET Core 2.x is and remains unsupported.

The following statements are specific for ASP.NET Core 2.x on .NET Framework:

ASP.NET Core 2.1 is and remains supported.
ASP.NET Core 2.2 is and remains unsupported.
We're re-versioning ASP.NET Core 2.1 as ASP.NET Core 2.3 to allow ASP.NET Core 2.2 users to move to a supported version.
Users on ASP.NET Core 2.1 should update to ASP.NET Core 2.3. Since it's the same code as ASP.NET Core 2.1, there are no breaking changes or feature additions. This operation won't require any code changes on your side. But it will make your life easier as all future updates will be versioned as 2.3.x, so you'll have a consistent set of versions.
Users on ASP.NET Core 2.2 update to ASP.NET Core 2.3. This will ensure you get off of the unsupported version and thus will get security fixes. You should expect breaking changes as you're effectively downgrading to the code from ASP.NET Core 2.1. If you can't live without the features being added in ASP.NET Core 2.2, you'll have to migrate to a supported .NET version with those features, such as .NET 8.
This does not extend or reduce the support durations of any products, nor which versions of .NET are supported where. It's purely a re-versioning of ASP.NET Core 2.1 in order to help the math in the package manager. The net effect of this change is that the last supported version of ASP.NET Core for .NET Framework is also the highest minor version (2.3).

WeihanLi commented 1 month ago

seemed no packages have been published so far

cremor commented 1 month ago

Please clarify which .NET Hosting bundle version we are supposed to use for ASP.NET Core 2.1/2.3. See also https://github.com/dotnet/AspNetCore.Docs/issues/22565

mkArtakMSFT commented 1 month ago

seemed no packages have been published so far !

This post was meant to give a heads-up, laying out a plan that we're executing on. We're working on building these packages and will have them published within a month or so.

dotnet / aspnetcore