.NET 8 and 9 End of Support: Runtime Migration Checks

.NET 8 and .NET 9 reached end of support on November 10, 2026. Microsoft’s current support policy lists both versions as out of support. Installing their final November patch does not move an application onto a supported runtime.

For application and security owners, this creates two work items: verify the last applicable correction and complete migration to a supported deployment. The decision depends on how the application gets its runtime. A host update and an application rebuild can affect different copies.

Use the current lifecycle table

These are the vendor policy’s dated values, not a promise that every application can run unchanged on either target. Microsoft requires supported releases to remain current with servicing patches. Select the target with the application owner and retain its exact release and operating-system support requirements.

A final patch is not a lifecycle migration

A patch ticket answers whether a defined correction is deployed. A lifecycle ticket answers whether the service runs on a maintained platform. Keep both results visible. An application on the final .NET 8 patch can be current within its old branch while that branch is already out of support.

Do not describe the support deadline as proof of a newly discovered vulnerability or an ongoing intrusion. It changes the maintenance position. The security consequence is that routine future fixes are no longer supplied under that branch’s support policy.

Find the runtime used by each application

Microsoft’s policy says applications using framework-dependent deployment can benefit from Microsoft Update, while self-contained applications remain responsible for keeping their packaged runtime current. Containerization is an inventory boundary rather than a third .NET packaging mode: inspect what the image actually contains.

An installed SDK inventory helps locate build tools, but does not prove which runtime a service uses. A shared runtime installed on the host does not identify the runtime inside every container or self-contained binary. Correlate deployment configuration, package provenance and supported service diagnostics for the exact application.

Choose the target through an application change

Review the application’s target framework, libraries, deployment mode, operating system and hosting environment. Choose an eligible supported runtime and follow its migration guidance. Treat source changes, dependency updates, build artifacts and runtime rollout as one reviewed application change.

Use a staging deployment to exercise the application’s real responsibilities: startup, authentication, authorization, database operations, scheduled work and required integrations. Record selected checks and actual observations. A successful build or process start alone does not establish application compatibility.

If a critical dependency prevents immediate migration, document the blocker, service owner, interim exposure decision and a dated next step. Calling the application patched must not silently close that lifecycle exception. Avoid removing shared runtime installations until their remaining consumers have been identified.

Verify the running deployment and rollback path

After release, reconcile the approved artifact with every serving replica and worker. Include scheduled jobs, infrequent batch tasks and standby instances. A newly built image in the registry is only the candidate artifact until the intended workload uses it.

Review rollback artifacts as well. A routine rollback can reintroduce an unsupported runtime even after the primary service migrates. Keep the rollback choice and its maintenance implications in the change record rather than counting the current deployment as permanent closure.

Application and owner:
Deployment mode and hosting environment:
Previous active runtime and last patch:
Supported target and lifecycle source date:
Approved artifact or container digest:
Serving replicas, workers and scheduled jobs:
Post-deployment runtime evidence:
Compatibility checks and observed results:
Rollback runtime and unresolved exceptions:

This unfilled record is a proposed migration acceptance method. It requires local observations; it is not evidence that any customer application has already migrated. Keep credentials and customer records out of the shared record.

Method: AI-assisted research and drafting against Microsoft’s support policy checked November 11, 2026. The lifecycle facts are vendor statements; the deployment matrix and acceptance record are operational analysis. No application migration or vulnerability test was performed for this article.