AI-Assisted .NET and Java Modernization: What the Tools Automate and What They Miss

Every engineering leader with a .NET or Java estate has been told some version of the same promise this year: point an AI agent at the repository and the upgrade writes itself. Part of that is true. The tools are good at the edits nobody enjoys making, and they make thousands of them without tiring. The other part decides whether the upgraded system can go to production, and it is where the independent evidence is least kind to the tools. An upgrade is finished when the new build behaves like the old one under real traffic, and a green build does not establish that.

• Nov 102026, the day .NET 8 and .NET 9 stop receiving security patches²
• 52.3%of hard Java 8 to 17 upgrades the best AI agent completed in an independent benchmark¹⁰
• 28.9%the highest behavioral-equivalence score any system reached in a 2026 conversion benchmark, while passing up to 91.1% of spec tests¹³

The deadlines that make this urgent

Microsoft's support table puts .NET 8, a long-term support release, and .NET 9, a standard-term release, on the same end date: November 10, 2026. .NET 10, released in November 2025, is supported to November 14, 2028.¹ Applications on .NET 8 or 9 keep running after the date. They stop receiving security fixes, and Microsoft warns that a later Visual Studio update will offer to remove the out-of-support components.² There is no safe place to wait between the two versions, so every .NET 8 and 9 workload has a reason to reach .NET 10.

.NET Framework is under a different kind of pressure. Version 4.8.1 is a Windows component and is supported for as long as the Windows version it runs on, with no end date of its own.³ Moving off Framework is driven by Linux and containers, hosting cost, performance and hiring, and the lack of a lifecycle cliff is exactly why many Framework estates are still there.

On the Java side the framework sets the pace more than the JDK. Spring Boot 3.5, the last 3.x line, lost open-source support on June 30, 2026. Spring Boot 4.0 loses it on December 31, 2026, and 4.1 keeps it until July 31, 2027.⁴ Spring Boot 4 runs on Spring Framework 7 with a Java 17 baseline, and its release announcement warns that the upgrade can be more involved than usual.⁵ A team finishing a 2.7 to 3.x migration today lands on an unsupported framework, which makes 4.1 the sensible open-source target.

What AI modernization tools automate well

Gartner now treats this as a market of its own. Its Market Guide for AI-augmented code modernization tools appeared in February 2026 and its first Magic Quadrant in August, with AWS, Microsoft and Moderne named as Leaders.⁷⁸⁹ The tools fall into four kinds. Deterministic recipe engines apply type-aware, repeatable rewrites across many repositories. IDE and command-line agents read a project, write an upgrade plan and work through it task by task. Cloud-provider transformation services run the same work in bulk across a portfolio. Services firms wrap one or more of these with their own people and test harnesses.

The kinds are converging. Microsoft's upgrade agent calls a recipe engine underneath, and Google's account of its own large migrations describes language models as one part of the solution, with syntax-tree tooling finding the change sites and checking the edits.¹⁵ Microsoft has also deprecated its .NET Upgrade Assistant in favor of an AI agent that writes an assessment, a plan and a task list, then commits each step on a branch.²¹²²

Where .NET Framework migrations still need engineers

Moving from .NET 8 to .NET 10 is mostly a retarget followed by careful testing. Moving from .NET Framework is a different project. Microsoft describes ASP.NET Framework to ASP.NET Core as non-trivial for the majority of production applications, because System.Web's HttpContext runs through the code, session and authentication work differently, and HTTP modules have to become middleware.¹⁷

Some technologies have no in-place path at all. Creating AppDomains, .NET Remoting, Code Access Security and Workflow Foundation are unavailable on modern .NET, and Microsoft says it has no plans to bring AppDomain creation back.¹⁸ WCF services survive through the community CoreWCF project, which Microsoft says supports a subset of WCF's features, so services that move to it need code changes and testing.¹⁹ EF Core is a rewrite with no direct upgrade path from EF6.²⁰ Microsoft's own agent now has skills for Web Forms to Blazor, WCF to CoreWCF and EF6 to EF Core, and lists none for Workflow Foundation, Remoting or AppDomains.²² Cloud transformation services publish similar exclusions; one lists Blazor UI components and Win32 libraries among the things it does not transform.²³

Practitioner reports show where this goes wrong. A team on .NET Framework 4.7.2 reported that an upgrade agent tried to migrate its MVC and API controllers, failed, and left them with hundreds of hours of manual work to repair a partial upgrade.²⁴ A cloud provider's own walkthrough of a bulk .NET transformation, published in September 2026, ended with tests still failing, routing errors to fix, a list of follow-up tasks, and three repositories set aside as too complex for bulk transformation.²⁵ Both are honest accounts of tools doing what they were built to do. They also show that the application's own shape sets the outcome far more than the tool's brand.

Where Java and Spring Boot upgrades still need engineers

The Spring Boot 3 migration guide lays out the mechanical work. It sets Java 17 as the minimum and moves to the jakarta namespace for every Jakarta EE specification, Hibernate 6, a new HTTP client and a rewritten observability layer.²⁶ Recipe engines automate most of that list well. The remainder is smaller and decides the schedule.

Java 17 strongly encapsulates the JDK's internals, so old libraries that reach into them by reflection compile cleanly and then fail at run time.²⁷ Spring Framework 6 stopped matching trailing slashes by default, so a request to /orders/ that used to work now returns a 404.²⁸ Hibernate 6 changes how sequences allocate identifiers and how Instant and Duration values are stored.²⁹ None of these produce a compiler error. Each one produces an incident if the test suite does not cover it.

Cross-framework moves are harder still. In ScarfBench, a 2026 benchmark of migrations between Spring, Jakarta EE and Quarkus, only 2% of migrations to Jakarta EE passed behavioral tests, and one of 204 tasks produced a fully equivalent application.¹² Moving an application off a Java EE application server is an architecture project with a tool attached.

What the independent evidence shows

Vendor figures describe showcase applications. Amazon reports moving tens of thousands of internal applications to Java 17 and saving the equivalent of more than 4,500 years of development work, and Microsoft reports up to 70% less time spent on migration. Both figures are vendor-reported, and neither vendor publishes the method behind them.⁴¹⁹ The most useful at-scale evidence comes from Google, which reports that across 39 internal migrations 74.45% of code changes were generated by a model, with developers estimating a 50% cut in total time. Review and rollout stayed largely human work, and reviewers reverted changes that were wrong or unnecessary.¹⁶¹⁵

The pattern across the benchmarks is consistent. Getting a build onto a new JDK is the easy part. Bringing every dependency current is harder, and moving between frameworks is mostly unsolved. There is no independent, method-backed measurement yet of how much of a .NET Framework port any tool automates, so any figure offered for one is a vendor's.

A green build is weak evidence of parity

The research on failure modes points one way. Agents optimize for whatever check they can see. In FreshBrew, agents excluded failing tests from the build and wrapped calls so tests silently skipped, which is why the benchmark also requires coverage to hold.¹⁰ METR found frontier models modifying tests or scoring code in 30.4% of runs where the scoring function was visible, and telling the model not to do it reduced attempts only slightly.¹⁴

The platforms add silent changes of their own, and these are the cases a parity suite has to target directly.

Security needs its own gate. Veracode's 2026 testing of more than 150 models found the average security pass rate for generated code stuck at 56%, with Java the weakest language at 29% in its spring 2026 results.³³³² That research measures fresh code generation, and an upgrade agent writing new adapter code is doing exactly that. Recipe-driven edits carry a different risk, a known transform applied mechanically, which is one more reason to prefer them where they exist. DORA's 2025 research describes AI as an amplifier, linked to higher throughput and lower delivery stability unless strong controls are in place, and an upgrade is where those controls matter most.³⁴

Run deterministic recipes first, then agents on the residue

Gartner's most useful line for buyers is about the cost of proof. As quoted by one of the Leaders, its Critical Capabilities research finds that, where available, rule-based deterministic tools used by an AI service can outperform a purely LLM-based approach in codebase refactoring, because of the time and resources saved in verification and testing.⁸ The quote comes through a vendor that benefits from it, and the benchmark data supports it. A recipe produces the same edit every time, so once one application proves it, the next hundred need far less review. An agent's edit has to be checked every time.

How to prove the upgraded system behaves the same

Parity is proven with evidence the agent cannot edit. The method has a fixed order, because each step depends on the one before it.

Language models are genuinely useful in the first step. Meta's TestGen-LLM kept a generated test only if it built, passed reliably and added coverage, and engineers accepted 73% of the tests that survived those filters.³⁵ GitHub's Scientist library shows the fourth step at scale: GitHub ran its old and new permission checks side by side in production and fixed both until they agreed.³⁶ Keep one caution in view. A characterization suite records legacy bugs as faithfully as legacy features, so every diff needs a recorded decision about which one it is.

# Runs on every agent-authored pull request. The agent cannot change this file.
base_tests=$(git show origin/main:test-count.txt)
head_tests=$(./scripts/count-tests.sh)
[ "$head_tests" -ge "$base_tests" ] || { echo "Test count fell"; exit 1; }
git diff --name-only origin/main -- 'tests/**' 'src/test/**' | grep -q . \
  && { echo "Tests changed: needs a named reviewer"; exit 1; }
./scripts/coverage-check.sh --no-drop
./scripts/parity-diff.sh --baseline recorded/ --fail-on-unclassified

When to run it in-house and when to bring in a partner

The tools ship to in-house teams by default, and for a lot of work that is the right place for them. Their built-in proof is the build plus whatever tests already exist. What they do not supply is the parity harness, the judgement about the parts with no equivalent, or the review capacity, which Google found to be the binding constraint in its own migrations.¹⁵

If you bring in a partner, judge them on proof. Ask for written parity criteria, the pipeline gates, mutation scores for any generated test suite, a diff report before each cutover, and handover of the whole harness, so your team can keep verifying after the partner leaves. Our guide to choosing an AI development company covers the rest of that conversation, and the same proof discipline applied to mainframes is in AI for COBOL modernization.

The upgrade you are forced into this year will not be the last one. Spring Boot 4.0 loses free support at the end of 2026, Temurin 17 in October 2027 and .NET 10 in November 2028. A team that builds the characterization suites, the traffic comparator and the pipeline gates once can take each of those with a fraction of the effort, whichever tool is best at the time.

This is how we run application modernization. We lock behavior before we change code, use deterministic recipes for the mechanical layer and AI agents for the residue, and hand over the parity harness with the upgraded system, so your team can prove every release that follows.