.NET Core 3.1 approaches end of life 

Every Microsoft product has a life cycle. The life cycle begins when a product is released and ends when it's no longer supported. .NET Core 3.1 was released on December 3, 2019, and reaches End Of Life (EOL) by 13 December 2022. The latest patch was .NET Core 3.1.28 and was released on 9 August 2022. 

End of support for Microsoft products

End of support refers to the date when Microsoft no longer provides fixes, updates or online technical assistance. End of support may also be referred to as 'end of life' or abbreviated 'EOL'.

As the end of support nears for a given .NET version, Microsoft recommends that you move to a newer .NET version, and reduce/remove your use of the given .NET version. After support ends, Microsoft recommends that you uninstall a given .NET version if you are no longer using it or install the latest patch, and accelerate your plans to remove your use of that .NET version.

Your use of out-of-support .NET versions may put your applications, application data, and computing environment at risk. Microsoft strongly recommends not using out-of-support software.

In November 2020, Microsoft released .NET 5 which is a successor to .NET Core 3.1.x. From then on, Microsoft committed to .NET which is open source and cross-platform. The latest version of .NET is .NET 6 which was released in November 2021 and will be supported until November 2024.

Microsoft also provides indefinite support for .NET Framework 4.8 as long as it is installed on a supported version of Windows.

Is my website impacted by this EOL?

Is the underlying technology of your website or application Microsoft .NET? Was it built after June 2016 and before November 2021? If so, there is a good chance that you may be on an unsupported version. 

Kentico Xperience

If your website was built on Kentico Xperience version 13 between October 2020 and November 2021, you may be on an unsupported .NET Core version. 

Kentico Xperience websites on version 12 or below, were built on the .NET Framework. If your website is on .NET Framework 4.8, Microsoft has indefinite support for the framework. But do note that Kentico has ceased support for Kentico Xperience 11 and below. With Kentico Xperience 12, technical support ends in December 2022 for MVC and December 2023 for portal engine websites.

Sitecore

With Sitecore, websites were primarily built on the .NET Framework. Thus, if your website is on .NET Framework 4.8, Microsoft offers indefinite support.

Sitecore currently offers extended support which includes security updates and fixes for Sitecore version 8 and above. If you are on Sitecore version 7.5 or below, extended support has ended. Sitecore 8.x extended support ends in December 2022 and Sitecore 9.0 extended support ends in December 2023. Versions 9.1 to 9.3 and 10.x have extended support from December 2024 to December 2027.

Optimizely

Optimizely websites on version 11 and below were built on the .NET Framework and have indefinite support from Microsoft for .NET Framework 4.8-based websites. If your site was built on Optimizely 12 and .NET 5, an upgrade is on the cards.

Episerver CMS pre-version 10, Ektron CMS pre-version 10, and Optimizely Content Cloud pre-version 10 passed their end of service life in 2020. Extended Security Update (ESU) period (if ordered separately) is slated to end in June and December 2023. 

Umbraco

Umbraco versions 8 and below utilised the .NET Framework. If those websites are on .NET Framework 4.8, an upgrade is not necessary. But if a website was built on Umbraco 9, there is a good chance that it would need to be upgraded to .NET 6.

Umbraco 6 reached EOL in May 2018 and Umbraco 7 reaches end of life in September 2022. Umbraco 8 has LTS until February 2025. Umbraco 9 has support until 16 December 2022, when it is considered EOL. Umbraco 10 is the current LTS version with support until June 2025. Umbraco follows Microsoft in defining its Long-term Support (LTS) and End of Life (EOL) policy.

Kontent.ai

Kontent.ai is a Software as a Service (SaaS) product that does need agency or client intervention for keeping its underlying technology current. The vendor takes care of patching and upgrading the service and its dependencies. 

But any client applications written in .NET need to be evaluated for EOL. If your Kontent.ai-powered website was built after June 2016 and before November 2021, there is a good chance you may need to upgrade to the latest .NET version.

If your web application was written in Next.js, Gatsby or a non-.NET technology, this EOL notification does not apply to you.

Umbraco Heartcore

If you are using Umbraco Heartcore and built or released your headless-driven website between June 2016 and November 2021, there is a high probability that your .NET web application will be out of support. The EOL does not affect the Heartcore SaaS platform as Umbraco HQ takes care of it. You would need to upgrade your website to .NET 6 to receive Microsoft support and security patches.

Custom applications

Even if your main website has been written in .NET 4.8, which has indefinite support, there may be APIs, serverless functions, scheduled jobs, Windows services and console applications written in .NET 3.1 or an unsupported .NET version.

It would be prudent to audit all ancillary services and integrations on your website to make sure that you identify which version of .NET they are built on and how long Microsoft will support those versions.

Not sure which version or where to start? Shout out to your friendly Producer at Luminary and they will be able to let you know.

Ignoring EOLs

Upgrading and keeping up-to-date with the latest version of .NET does come with a price tag and you may be tempted to not upgrade. You may want to wait until your next major rebuild or reskin of your website or application. Let’s take a look at some reasons why you should upgrade.

Operational risks

When the underlying technology is out of support, it creates risks for day-to-day business operations. For example,  a critical web application still works but web browsers no longer support the old encryption in transit methods used by the web application. If these risks materialise, they can cause business interruption, driving up costs and creating client unhappiness.

Security vulnerabilities

If you keep using EOL software, you risk being hacked since new security patches are not issued. For .NET Core 3.1, no patches will be issued from December 2022. If a hacker finds a way to exploit a particular vulnerability in .NET Core 3.1, and Microsoft is not issuing security patches, that vulnerability will remain open for the hacker to use. This could result in data breaches or other security vulnerabilities. 

Compliance risks

Regulatory scrutiny is on the rise, therefore compliance with regulatory requirements is no longer an option. GDPR, PCI-DSS and APRA CPS234 are prominent examples, and they require that all technologies used must be supported. For example, you will be in breach of PCI-DSS compliance by using .NET Core 3.1 after 13 December 2022. Compliance risks on EOL systems are similar to cyber security risks. By failing compliance requirements with legacy systems or software, a business can face hefty fines, particularly in the event of a data breach.

Maintenance costs

Using EOL technologies such as .NET Core 3.1 increases the cost of maintenance. As developers move on to new technologies, it becomes hard to hire and retain developers on older technologies. This would increase the cost of engaging human resources. In addition, development and DevOps tooling would sunset obsolete technologies and this would mean using workarounds, which would increase costs. 

Next steps

If you have identified that your website or application is running on an unsupported .NET version, the next step is to look at upgrading it. Luminary recommends upgrading to .NET 6 as it’s the current Long Term Support (LTS) version supported by Microsoft.

Reach out to your Account Director or Producer at Luminary to get an upgrade booked.

Keeping on top of software support life cycle 

At Luminary, we maintain a registry of technologies, libraries and tools across the different projects we support on a regular retainer. This allows us to proactively communicate EOL notifications well in advance of sunset dates.

Operating EOL systems and software may be tempting but the financial, security, and compliance risks far exceed the benefits. All serious technology providers such as Microsoft provide plenty of advanced notice before sunsetting an obsolete technology. Businesses that adhere to these announcements and move off legacy technologies save more than investment dollars. They may also save their reputations and customer loyalty. Remaining or relying on EOL technology is just not worth the risk.