Is ASP.NET Core on .NET Framework still supported?

[cremor]

I'd like to know if ASP.NET Core - specifically version 2.1 - is still supported if it is running on the .NET Framework runtime. With "supported" I only mean "is still getting security fixes" in the context of this question.

According to the .NET Core and .NET 5 Support Policy:

ASP.NET Core 2.1 on .NET Framework

Support for ASP.NET Core 2.1 on .NET Framework matches the ASP.NET Support policy for other package-based ASP.NET frameworks. The complete list of packages covered by this policy can be seen in ASP.NET Core 2.1 Supported Packages.

The first link (ASP.NET Support) says this:

[...] the following ASP.NET Core 2.1 (latest patched version only) packages will be supported on the .NET Framework and follow the support cycle for those .NET Framework versions.

Although there is no "following" list, I assume they mean the packages link. That page lists ASP.NET Core packages, e.g. the "main" package "Microsoft.AspNetCore".

So all of this seems to indicate that ASP.NET Core 2.1 on .NET Framework is still supported.
Question 1: Is this correct?

But the last released AspNetCore package is 2.1.7 from January 2019, whereas the current 2.1.x version of .NET Core is 2.1.24 from January 2021.
Question 2: Why are there no updates for the ASP.NET Core NuGet package for 2 years even though it should still be supported?

If it's still supported, doesn't this also mean that ASP.NET Core 2.1 on .NET Framework is supported as long as the .NET Framework itself is supported - which bascially means as long as the Windows version it's running on is supported? So even after .NET Core 2.1 support ends on August 21, 2021, ASP.NET Core 2.1 on .NET Framework should still get security updates, right?
Question 3: Is this correct, so will we basically get security updates "forever"?

[davidfowl]

So all of this seems to indicate that ASP.NET Core 2.1 on .NET Framework is still supported.
Question 1: Is this correct?

Yes it is.

But the last released AspNetCore package is 2.1.7 from January 2019, whereas the current 2.1.x version of .NET Core is 2.1.24 from January 2021.
Question 2: Why are there no updates for the ASP.NET Core NuGet package for 2 years even though it should still be supported?

@Pilchie ?

Question 3: Is this correct, so will we basically get security updates "forever"?

Yep. The ones that we deem important enough to back port to 2.1. That's correct.

cc @DamianEdwards @Pilchie to check my answers

[Pilchie]

Yes, all of that is correct. As for packages, in the 2.1 world, we only publish packages that are directly affected by a servicing change, we don't push all packages, or all packages that transitively reference the affected package.

This isn't ideal because it means you have to watch for bulletins in packages you transitively depend on and lift them, but there other reasons that make it difficult for us to re-publish all transitive packages.