Running 4.6.1 application on 4.8 framework: What issues will I encounter

We currently have a whole suite of applications targeted to framework 4.6.1. These run across our estate, including 400+ remote POS units.

I see that framework 4.6.1 went out of support in April 2022. I need to understand how best to move forward back on to a supported platform.

The obvious issue that comes to mind is security patches. Now that 4.6.1 is unsupported no further security patches will be available potentially opening up our network to vulnerabilities. This gives me my first thought of installing framework 4.8 on our client machines and letting our applications, still targeted to 4.6.1, run under 4.8.

Will this mean that we will be covered by security patches installed to the 4.8 framework as the runtime will be 4.8, can we get away with NOT retargeting our projects?

The second thought is to install 4.8 on our client machines and re-target the applications to 4.8. We have various different code sets that run together as larger applications but there is also a cross-over between classes within these applications so re-targeting and maintaining compatibility will be a challenge. Also, how do I identify any regressed functionality between 4.6.1 and 4.8?

Finally, should I look at .NET 5.0?

1. Q: Does client and server OS installations of .NET Framework v4.8 receive security patches?
   • A: Yes. At time of answer, for v4.8, there is no Support End Date and cumulative update has been issued on 2023-11-14.
     1. https://support.microsoft.com/en-us/topic/november-14-2023-kb5031989-cumulative-update-for-net-framework-4-8-for-windows-10-version-1607-and-windows-server-2016-016cab6a-0bfd-407d-8718-3a4b1af65e0e
     2. https://learn.microsoft.com/en-us/lifecycle/products/microsoft-net-framework
     3. https://devblogs.microsoft.com/dotnet/net-framework-4-8-is-available-on-windows-update-wsus-and-mu-catalog
2. Q: Does built code targeting v4.6.1 have to be re-compiled to target v4.8 to be supported?
   • A: No, my understanding is, so long as built code is running on a supported .NET Framework version (v4.8), it is considered supportable.
   • https://devblogs.microsoft.com/dotnet/net-framework-4-5-2-4-6-4-6-1-will-reach-end-of-support-on-april-26-2022
     • Quote: "Customers currently using .NET Framework 4.5.2, 4.6, or 4.6.1 need to update their deployed runtime to a more recent version – at least .NET Framework 4.6.2 before April 26, 2022 – in order to continue to receive updates and technical support."
3. Q: For code targeting .NET Framework 4.6.1, what challenges are there upgrading to target 4.8?
   • A: This depends on how spicy the code base is, does it use exotic unusual API's or poorly maintained NuGet pkgs. The below release note links start at v4.6.1. Read from there to v4.8 to understand changes.
     1. https://learn.microsoft.com/en-us/dotnet/framework/migration-guide/versions-and-dependencies#net-framework-461
     2. https://learn.microsoft.com/en-us/dotnet/framework/whats-new/#whats-new-in-net-framework-461
4. Q: Should migrating from .NET Framework to .NET be considered?
   • A: Yes. .NET Framework is considered legacy platform with MS focusing on .NET. This migration might be more challenging than v4.6.1 to v4.8 due to OS, and NuGet pkg dependencies. .NET opens a host of newer technologies like Kestrel web server and use of HTTP 2 etc.
     1. https://learn.microsoft.com/en-us/dotnet/standard/choosing-core-framework-server
     2. https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?view=aspnetcore-8.0