ASP.NET Core 2.3?

Bluehill · 9월 18, 2025, 12:04오후

ASP.NET Core 2.1 becomes ASP.NET Core 2.3

열림 09:05PM - 23 Oct 24 UTC

닫힘 11:36PM - 18 Aug 25 UTC

announcement area-networking

We'll be reshipping ASP.NET Core 2.1 as ASP.NET Core 2.3 and encourage ASP.NET C…ore 2.2 users to update to it. In this post I'll provide more background. > [!NOTE] > > This post only applies if you're using ASP.NET Core **on .NET Framework**. If you're using ASP.NET Core 2.x on .NET Core 2.x, it is [already out of support][netcore-support], and you should upgrade to a supported version such as .NET 8. ### Background Early versions of ASP.NET Core were provided for .NET Framework and .NET Core. Since 2021, [ASP.NET Core 2.1 is supported][aspnet21-support] only when running on .NET Framework. ASP.NET Core 2.2 has been out of support on all platforms since 2019. This happened before we had a [predictable schedule and alternate releases of Standard Term Support (STS) and Long Term Support (LTS)][core-release-policies]. Many users upgraded to ASP.NET Core 2.2, not realizing that this reduced their support duration. As a result, we now have users that are running on the unsupported version of ASP.NET Core 2.2 on .NET Framework. | Product | .NET Framework Support | | ---------------- | ----------------------------- | | ASP.NET Core 2.1 | [Supported][aspnet21-support] | | ASP.NET Core 2.2 | Ended December 23, 2019 | ### How to stay supported * If you're on .NET Core, you should upgrade to .NET 8 and use ASP.NET Core 8 * If you're on .NET Framework, you can either migrate to .NET 8 or upgrade to ASP.NET Core 2.3, which is the same code as ASP.NET Core 2.1 (see below) Since ASP.NET Core 2.x for .NET Framework is just a set of packages, downgrading isn't that easy; there are well over one hundred packages and not all of them have 2.x version numbers. To make matters worse, there are NuGet packages out there that also upgraded to ASP.NET Core 2.2. Downgrading to ASP.NET Core 2.1 would mean that NuGet fails to restore these dependencies with errors. In order to make this easier, we'll reship ASP.NET Core 2.1 as ASP.NET Core 2.3, thus facilitating this downgrade as a package upgrade. You might wonder why we don't reship ASP.NET Core 2.2 as 2.3 instead. The answer is breaking changes. ASP.NET Core 2.2 went out of support five years ago, while ASP.NET Core 2.1 kept being supported. We feel it would be wrong to force ASP.NET Core 2.1 users to accommodate those breaking changes in order to stay supported. Users on ASP.NET Core 2.2 are unsupported and won't receive any security updates. Our priority is to help those users to get onto a supported version of ASP.NET Core for .NET Framework. By reshipping ASP.NET Core 2.1 as ASP.NET Core 2.3, we provide users on ASP.NET Core 2.2 an off ramp to the supported version via a regular NuGet upgrade. Users on ASP.NET Core 2.1 will also be pulled forward to 2.3, but since it's the same code as 2.1, there are no breaking changes. Moving forward, all updates to ASP.NET Core 2.1 will be published as 2.3. However, if you're using ASP.NET Core 2.1, you don't need to move to 2.3 in order to get updates. If we find security issues with 2.1 packages, those will be marked as vulnerable and the recommended version will be versioned as 2.3. Except for the version number changes, that's how ASP.NET Core 2.1 works today, so there are no changes for you and you don't need to preemptively update to ASP.NET Core 2.3 to receive those warnings. > [!CAUTION] > > Please note that if you're using ASP.NET Core 2.2, you will *not* be getting vulnerability warnings via NuGet because the product is out of support. There is no change here, this has been the case since ASP.NET Core 2.2 went out of support five years ago. Therefore, if you're on ASP.NET Core 2.2, we strongly recommend to update to ASP.NET Core 2.3 as soon as possible in order to receive security fixes again. We understand that this can be confusing, but we believe it's the best compromise to help ASP.NET Core 2.2 users to get back onto a supported train. | Product | .NET Framework Support | | ---------------- | ----------------------------------------------- | | ASP.NET Core 2.1 | Supported with ASP.NET Core 2.3 | | ASP.NET Core 2.2 | Ended December 23, 2019 | | ASP.NET Core 2.3 | [Supported, same code as 2.1][aspnet21-support] | ### Summary For .NET Core, ASP.NET Core 2.x is and remains unsupported. The following statements are specific for ASP.NET Core 2.x on .NET Framework: * **ASP.NET Core 2.1 is and remains supported**. * **ASP.NET Core 2.2 is and remains unsupported**. * **We're re-versioning ASP.NET Core 2.1 as ASP.NET Core 2.3** to allow ASP.NET Core 2.2 users to move to a supported version. * **Users on ASP.NET Core 2.1 should update to ASP.NET Core 2.3**. Since it's the same code as ASP.NET Core 2.1, there are no breaking changes or feature additions. This operation won't require any code changes on your side. But it will make your life easier as all future updates will be versioned as 2.3.x, so you'll have a consistent set of versions. * **Users on ASP.NET Core 2.2 update to ASP.NET Core 2.3**. This will ensure you get off of the unsupported version and thus will get security fixes. You should expect breaking changes as you're effectively downgrading to the code from ASP.NET Core 2.1. If you can't live without the features being added in ASP.NET Core 2.2, you'll have to migrate to a supported .NET version with those features, such as .NET 8. * **This does not extend or reduce the support durations of any products, nor which versions of .NET are supported where**. It's purely a re-versioning of ASP.NET Core 2.1 in order to help the math in the package manager. The net effect of this change is that the last supported version of ASP.NET Core for .NET Framework is also the highest minor version (2.3). [aspnet21-support]: https://dotnet.microsoft.com/platform/support/policy/aspnet/2.1-packages [netcore-support]: https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core [core-release-policies]: https://github.com/dotnet/core/blob/main/release-policies.md

돌아다니다가 좀 재밌는 사실을 발견했습니다.

닷넷 코어 2.2까지만 해도 ASP.NET Core를 닷넷 프레임워크에서도 사용할 수 있었습니다. 하지만 안타깝게도 닷넷 코어 3.0부터의 ASP.NET Core는 닷넷 프레임워크에 대한 지원을 끊었습니다.

문제는 여기서 발생했습니다. ASP.NET Core 2.1은 닷넷 코어 2.1의 지원이 끝난 이후로도 닷넷 프레임워크에서 사용하는 경우에 한해서 계속 지원되었습니다. 반면에 ASP.NET Core 2.2는 닷넷 프레임워크에서도 .NET Core 2.2와 함께 지원이 종료되었습니다.

그래서 닷넷 프레임워크에서 ASP.NET Core 2.2 패키지를 사용하고 있다면 업데이트가 끊겨서 보안이 취약한 상태가 됩니다. 이러한 ASP.NET Core 2.2 사용자들을 구원(?)하기 위해서 ASP.NET Core 2.3을 올해 초에 내놨다는 겁니다. 주의할 점은 이 2.3은 2.2가 아닌 2.1의 리패키징(2.1의 코드를 그대로 유지하고 버전만 올렸다는군요.)이기 때문에 2.1 사용자들은 문제 없이 업그레이드할 수 있지만 2.2 사용자들은 2.2에 추가된 기능들을 전부 제거해야 한다는 겁니다.

솔직히 말해서 2.1 사용자들은 당연히 업그레이드해도 되겠지만 2.2 사용자들은 얼마나 업그레이드할지는 모르겠습니다. 물론 2.2의 기능을 안쓰는데도 2.2로 업그레이드해버렸다면 2.3으로 업그레이드해도 문제는 없을 것 같기는 합니다만, 2.2의 기능을 사용하고 그걸 없앨 수 없다면 어차피 기술 부채인데 최신 닷넷으로 마이그레이션하는게 장기적으로 보면 더 싸게 먹히지 않을까 싶거든요.

leechw9 · 9월 19, 2025, 12:01오전

정말 엉뚱한 버전 이름입니다.