asp.net 4.8 runtime is patched as part of O/S patches. the runtime includes asp.net and webforms.
MVC, signal/r and webapi are nuget packages added to the project. these are "patched" by updating the version number in specified in packages.config file and rebuilding the project.