I'd like to know if ASP.NET Core - specifically version 2.1 - is still supported if it is running on the .NET Framework runtime. With "supported" I only mean "is still getting security fixes" in the context of this question.
According to the .NET Core and .NET 5 Support Policy:
ASP.NET Core 2.1 on .NET Framework
Support for ASP.NET Core 2.1 on .NET Framework matches the ASP.NET Support policy for other package-based ASP.NET frameworks. The complete list of packages covered by this policy can be seen in ASP.NET Core 2.1 Supported Packages.
The first link (ASP.NET Support) says this:
[...] the following ASP.NET Core 2.1 (latest patched version only) packages will be supported on the .NET Framework and follow the support cycle for those .NET Framework versions.
Although there is no "following" list, I assume they mean the packages link. That page lists ASP.NET Core packages, e.g. the "main" package "Microsoft.AspNetCore".
So all of this seems to indicate that ASP.NET Core 2.1 on .NET Framework is still supported.
Question 1: Is this correct?
But the last released AspNetCore package is 2.1.7 from January 2019, whereas the current 2.1.x version of .NET Core is 2.1.24 from January 2021.
Question 2: Why are there no updates for the ASP.NET Core NuGet package for 2 years even though it should still be supported?
If it's still supported, doesn't this also mean that ASP.NET Core 2.1 on .NET Framework is supported as long as the .NET Framework itself is supported - which bascially means as long as the Windows version it's running on is supported? So even after .NET Core 2.1 support ends on August 21, 2021, ASP.NET Core 2.1 on .NET Framework should still get security updates, right?
Question 3: Is this correct, so will we basically get security updates "forever"?
2025 Update:
ASP.NET Core 2.1 is now called ASP.NET Core 2.3 and continues to be supported when running on the .NET Framework runtime! See announcement blog post.
Original Post:
I've got an answer from a Microsoft employee here.
TLDR: Yes, ASP.NET Core 2.1 on .NET Framework ist still supported and will be supported as long as the .NET Framework. The NuGet package didn't get any updates because they don't publish new packages for transitive reference updates.
Edit: Sadly Microsoft disabled the discussions on the linked repository, so the post is no longer available. (Edit 2: Now enabled again!) But a recent blog post that highlighted the end of life of .NET Core 2.1 it was also mentioned that this doesn't affect ASP.NET Core 2.1 on .NET Framework:
Note: support for ASP.NET Core 2.1 on .NET Framework matches the support policy of the .NET Framework. See the ASP.NET Support Policy for more details
The linked ASP.NET Support Policy contains this:
To help facilitate migrating applications to ASP.NET Core on .NET Core, the following ASP.NET Core 2.1 (latest patched version only) packages will be supported on the .NET Framework and follow the support cycle for those .NET Framework versions. ASP.NET Core 2.1 is defined as "Tools" in the Microsoft Support Lifecycle Policy. A "Tool" requires a minimum of 12 months notification prior to the end of support. For more information, please see this KB Article.
The "packages" link links to the page "ASP.NET Core 2.1 and ASP.NET 5.2.7 Supported Packages". That page states
The package lists below represents the supported ASP packages when using ASP.NET Core 2.1 on .NET Framework.