Safeguard
Developer Tools•

.NET LTS or STS: which release should you choose?

LTS .NET releases get three years of support and STS releases get two. Choose LTS for services you do not touch often, STS only if you upgrade yearly.

Safeguard Security Team
3 min read

Choose LTS for services you will not touch often, and STS only if your team reliably upgrades every year. Microsoft's support policy gives LTS releases three years of support and STS releases two. Even numbered releases are LTS, so .NET 10 is the current LTS and .NET 9 is STS.

Definitions

LTS means Long Term Support. The policy page says even numbered releases are LTS and receive free support and patches for three years after the initial release.

STS means Standard Term Support, previously called "Current." Odd numbered releases are STS and receive free support and patches for two years.

Maintenance period. The last six months of support for any release get security mitigations only.

Latest patch rule. Customers must install the latest patch to remain supported.

Side by side

LTSSTS
NumberingEven (8, 10)Odd (9)
Support lengthThree yearsTwo years
Final six monthsSecurity mitigations onlySecurity mitigations only
Example.NET 10, to 2028-11-14.NET 9, to 2026-11-10

The trap

STS looks like a way to get new features sooner. It is, but the two year window means that a service you shipped on STS and then left alone is out of support sooner than you expect. .NET 9 ends on the same day as .NET 8 (10 November 2026), even though 8 was released a year earlier.

How to choose

  1. Will you touch this service every year? If yes, STS is viable. If no, LTS.
  2. Do you ship to customers? Libraries and shipped software benefit from LTS, because customers upgrade slowly.
  3. Do you need a feature only in the newer release? Check that it truly is not in the current LTS.
  4. How fast can you roll a runtime change? If it takes more than a quarter, favor LTS.

A mix is fine. Internal prototypes can follow STS while core services stay on LTS.

Make the choice enforceable

Record the target framework in a shared file such as Directory.Build.props so one edit changes every project. Pin the SDK in CI with global.json, where the rollForward value controls how far it may move. In the Microsoft docs, latestFeature accepts newer feature bands and patches for the same major and minor version.

{
  "sdk": {
    "version": "10.0.100",
    "rollForward": "latestFeature"
  }
}

The version field needs a full number, and does not accept values like 10 or 10.0.

Try it yourself

The framework mapping demo shows how a technical setting can be connected to a written control. A rule such as "production runs an LTS release" can be tracked the same way.

Click through it at your own pace, or open it full screen.

Safeguard's compliance and evidence automation can track versions and policies over time. The free scan is at gold.safeguard.sh/scan.

Quick check

Is STS less secure than LTS?

Not while it is supported. It is simply supported for a shorter time.

What does the policy mean by the latest patch?

Supported releases need the newest patch installed. Running an old patch of a supported release is not covered.

See .NET 9 support ends 10 November 2026.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.