Today we are announcing that ASP.NET Core 2.3 will reach end of support on April 7, 2027. After that date, Microsoft will no longer provide security patches, bug fixes, or technical support for ASP.NET Core 2.3.
This announcement provides the required 12 months of advance notice, as defined by the Microsoft Support Lifecycle Policy for products classified as “Tools.”
Current support policy
ASP.NET Core 2.3 packages (latest patched version only) are currently supported on .NET Framework, following the support cycle for those .NET Framework versions. After April 7, 2027, this support will end regardless of the .NET Framework version in use.
Note that the ASP.NET Core 2.3 packages include the Entity Framework 2.3 packages, which will end support on the same date.
Impact of end of support
After ASP.NET Core 2.3 reaches end of support:
- Your applications will continue to run. End of support does not break existing applications.
- No new security updates will be issued for ASP.NET Core 2.3.
- Continuing to use an unsupported version may expose your applications to security vulnerabilities.
- Technical support will no longer be available for ASP.NET Core 2.3.
- The ASP.NET Core 2.3 packages will be deprecated.
Upgrade recommendation
We understand that upgrading is an investment, and we want to make the process as smooth as possible. Modern versions of .NET offer significant improvements in performance, security, and developer productivity that make the upgrade well worth the effort.
We recommend upgrading to a currently supported version of .NET, such as .NET 10 (LTS).
To help with the upgrade process, we recommend using GitHub Copilot modernization, which provides AI-powered assistance to help you analyze, plan, and execute your migration to a modern .NET version.
Resources
Closing
ASP.NET Core 2.3 will reach end of support on April 7, 2027. We strongly recommend starting your migration to a supported version of .NET today, leveraging tools like GitHub Copilot modernization to facilitate the process. If you have any questions or need assistance, please reach out to us through our support channels.
The ASP.NET to ASP.NET Core migration documentation includes the use of the Microsoft.AspNetCore.DataProtection.SystemWeb package, to protect data in a manner compatible with ASP.NET Core.
That package is currently listed as an ASP.NET Core package and thus would be included in this deprecation.
What is the plan for supporting migrations from ASP.NET to ASP.NET Core after next April?
Thanks for bringing this to our attention. We’re looking at options for updating this guidance.
Suddenly treating the ASP.NET Core 2.3 runtime packages as “tools” to justify the fact you’ll no longer honor the support duration you had initially announced is honestly infuriating.
The post doesn’t mention it, but I suspect Entity Framework Core 2.3 will get the same treatment?
Hi Kévin. The “Tools” designation for ASP.NET Core 2.3 isn’t actually new. It’s always been designated that way in the ASP.NET Core 2.3 support policy. We certainly understand thought that it’s never pleasant when support ends for a technology that you’re using.
The EF Core 2.3 packages are included in the ASP.NET Core 2.3 package listing. I agree that’s not clearly called out in this announcement. I’ll get that clarified in the post.
Even after the 2.1 → 2.3 transition, there is ongoing cost to maintain a library like this. Security expectations and compliance standards continue to rise over time (for example, through initiatives like the Secure Future Initiative), and meeting those standards requires continual investment. That cost does not stop once a version has shipped or been stabilized, and it pulls resources from investment in our modern .NET platform.
ASP.NET Core support on .NET Framework was originally preserved to ease migrations from classic ASP.NET to ASP.NET Core. Since ASP.NET Core 2.3, however, we’ve shipped nine additional releases, and the platform has continued to...
Thanks. Good point regarding the "Tools" designation: after checking, it's indeed not new. Even ASP.NET MVC 5, ASP.NET Web API 2 and Entity Framework are also listed as "tools" in KB2902020: https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/aspnet/development/support-lifecycle-web-stack (tho' it doesn't make much sense to call these runtime libraries "tools", but heh).
Such decisions would feel less arbitrary if the reasons behind them were mentioned: downloads on NuGet.org indicate that the 2.3 version of the ASP.NET Core packages are still massively used, so it's not like 2.3 is no longer used anywhere. Maintaining this version certainly has a cost, but wasn't that cost mostly paid during the...