Software Engineering · Chapter 14 of 31
The framework landscape, measured
React under a new owner, a compiler instead of signals, a Vue release everyone thinks shipped and hasn't, and the two-thirds of the web nobody writes blog posts about.
This chapter is deliberately full of numbers and versions, because the fastest way to sound current in a frontend interview is to be current, and the fastest way to sound stale is to quote a framework fact that stopped being true eighteen months ago. Everything below is dated. Check it before you quote it — this field moves faster than any chapter can.
First, the reality check
Hold all three in mind at once. Developer surveys tell you what the people who answer surveys are building now. Crawls of the live web tell you what is deployed. Package registry downloads tell you mostly about continuous-integration pipelines.
Current stable versions as of 25 August 2026, straight from the package registry: React 19.2.8 · Next.js 16.3.3 · Angular 22.1.3 · Vue 3.5.41 · Svelte 5.56.10 · Vite 8.2.2 · React Native 0.87.0 · Astro 7.2 · Flutter 3.47.0.
React: new owner, a compiler, and two serious security events
React is no longer owned by Meta. The React Foundation launched under the Linux Foundation on 24 February 2026, taking ownership of React, React Native and JSX. Platinum members include Amazon, Callstack, Expo, Huawei, Meta, Microsoft, Software Mansion and Vercel; the executive director is Meta's former head of React.
“Who owns React?” is a good interview question precisely because most candidates still answer Meta.
React Compiler reached 1.0 on 7 October 2025. It does build-time automatic memoisation, works back to React 17 with a runtime shim, and is enforced through the hooks lint plugin. Meta's own published results — vendor figures, so treat accordingly — are up to 12% faster initial loads and navigations and 2.5× on certain interactions, memory-neutral. It is on by default in recent Expo SDKs and opt-in elsewhere. A Rust port now exists, with the framework vendor reporting 20–50% compile-time wins on large applications.
And the security record of Server Components is genuinely bad so far. A December 2025 advisory carried a CVSS 10.0 — unauthenticated remote code execution through any Server Function endpoint, across several bundler integrations. The detail that makes it worth teaching: applications that never wrote a single Server Function were still vulnerable if they supported Server Components at all. A denial-of-service and source-exposure advisory followed a week later.
React's own documentation also notes that the bundler-facing Server Component APIs do not follow semantic versioning and can break between minor releases. That is a real operational cost teams underestimate.
What React uniquely solves, stated fairly: the hiring market and the component ecosystem. Nothing else lets you staff a team in a week. And Server Components are the only mainstream server-component model that ships a serialisation protocol, so a server tree can stream into a client tree — islands and resumability do not do this.
What it is genuinely bad at: being predictable about cost. The Server Component boundary is an architectural commitment, not an optimisation toggle, and once use client spreads through a codebase you can ship more JavaScript than the single-page application you replaced.
Next.js, and the middleware lesson worth memorising
Next.js 16 (21 October 2025) made Turbopack the default bundler, introduced opt-in Cache Components with a dynamic-by-default posture, renamed middleware to a proxy file running on Node, and removed a long list of legacy APIs including synchronous access to params, cookies and headers.
Never put your only authorisation check in middleware
A March 2025 advisory, CVSS 9.1, let an attacker bypass Next.js middleware entirely by spoofing a single internal header — including any authentication or authorisation logic living there.
The patch matters far less than the architectural lesson, which generalises well beyond one framework: an edge or middleware layer is a good place to redirect and a bad place to be the only gate.
Authorisation belongs as close to the data as you can put it — in the server function, in the route handler, in the database policy. Middleware is a convenience layer, and convenience layers get bypassed.
This is one of the best available interview questions for a senior frontend role, because it separates people who have shipped from people who have read the docs.
And note the satisfaction picture, which is not what the usage numbers suggest: in the most recent large ecosystem survey, Next.js leads on usage while trailing Astro on satisfaction by 39 points. Partly that is a category comparison — a content tool against an application framework — and partly it is real.
The correction most 2026 writing gets wrong
Vue's Vapor Mode has not shipped. A great deal of current writing describes it as if it had.
As of 25 August 2026 the registry's stable tag for Vue is 3.5.41. Version 3.6 sits at release candidate 5.
Vapor Mode — compiling components without a virtual DOM — is opt-in per single-file component, requires the composition-API script setup form, and is incompatible with the Options API. Nuxt supports it in interop mode: a virtual-DOM application with individual components opted in.
This is a good habit to generalise. Before repeating a framework feature as shipped, check the registry's stable tag. Release-candidate features get written about as if they are current for months before they land, and occasionally they never land at all.
Angular, which most candidates' mental model is stalest on
Angular changed more in the last two years than in the previous five, in a direction people do not expect:
- Angular 21 (20 November 2025): zoneless change detection becomes the default, Karma is replaced by Vitest as the default test runner, Signal Forms arrive experimentally.
- Angular 22 (3 June 2026): the signal-first consolidation. The Resource API and Signal Forms go stable, Zone.js is no longer included for new projects, and on-push change detection becomes the default — a component that sets nothing no longer uses check-always.
- What Angular uniquely solves: it is the only mainstream option shipping routing, forms, HTTP, dependency injection, internationalisation, testing and a command-line interface as one versioned unit on a fixed six-month cadence with long-term support. For a bank or a two-hundred-engineer organisation, that is the product.
- And it is nowhere near dead. It appears in roughly 20% of frontend job postings — higher than its share of developer-survey respondents, because enterprises post more roles per developer than startups do. The postings are concentrated exactly where the stable jobs are.
The rest of the field, honestly
| What it uniquely solves | What it is genuinely bad at | |
|---|---|---|
| Svelte 5 | The least framework code per unit of application, and a runes model that reads like plain assignment. Top developer-experience scores and the highest professional interest of any JS library | Ecosystem depth and hiring. 0.2% of sites. High admiration, low deployment — that combination is the whole story |
| Solid 2.0 (beta) | The cleanest fine-grained reactivity in the ecosystem with a React-shaped API; top satisfaction five years running | Adoption, and a large 2.0 migration that historically costs small frameworks their momentum. Its meta-framework is folding back into the core as a mode |
| Astro 7 | Content sites. Zero JS by default, islands where you ask, and it hosts React/Vue/Svelte components side by side. Server Islands extend this to deferred per-component rendering | Application-shaped products. The moment your islands need to talk to each other you are hand-rolling a framework |
| Qwik | Resumability — serialising listener references into the HTML so there is no hydration pass at all, only a resume. The only mainstream implementation of the idea | Being a safe bet. Learn the idea, do not stake a career on the stack |
| htmx | The case where your team is a backend team and your app is forms and tables. Internal tools, admin panels, configurators | Optimistic UI, offline, complex client state. 0.1% of sites — a legitimate architectural option and a poor career bet at the same time |
| TanStack Start | The credible non-Vercel full-stack React answer, built on TanStack Router. Grew roughly thirtyfold in npm terms over 2026 | Maturity. It appeared in the last big survey only as write-in mentions because it was not a listed option |
Signals everywhere, except one
The most interesting architectural contrast in the field right now: Angular, Vue, Svelte, Solid, Preact and Qwik have all converged on fine-grained signal reactivity. React deliberately did not. It kept the re-render-and-diff model and solved the cost with a compiler instead.
The trade-off, which is a genuinely good interview answer: signals give you precise, predictable, minimal updates — at the cost of a reactive-ownership mental model that leaks into every API you touch. React's model keeps components as pure functions of props and state and pushes optimisation into the build — at the cost of an opaque compiler you have to trust.
On the standards track: the TC39 Signals proposal's own repository states Stage 1, with a deliberately conservative advancement plan requiring production polyfills and multi-framework integration before requesting Stage 2. Several secondary sources claim Stage 2 in late 2025; that is not confirmed at the proposal repository, so do not assert it. The repository's own estimate is at minimum two to three years after standardisation before native availability across browsers — which means signals are a framework feature for the rest of this decade, not a platform feature.
What the job postings actually ask for
From analyses of 2026 frontend postings — secondary data with unpublished methodology, so treat the exact percentages as soft and the ordering as sound:
- TypeScript appears in roughly 36% of frontend postings and is associated with a substantial salary premium over plain JavaScript. If you optimise one thing, optimise this.
- React and TypeScript co-occur in about a quarter of the sampled market — the single most common pairing.
- Angular around 20%; Vue and Next.js in the 7–11% band each.
- The full-stack pool is growing faster than the pure-frontend pool, particularly engineers fluent end-to-end with server components and edge runtimes.
The structural argument behind that last point is worth being able to make out loud. Meta-frameworks caused it. When your route file runs on the server, your data fetch is a server function, your cache invalidation is a framework API and your deploy target is an edge runtime, the frontend job has absorbed request handling, caching strategy, database access patterns and deployment topology. Server Components did not just change React — they changed the job description. Expect a 2026 frontend loop to ask about cache invalidation semantics, N+1 queries inside a server component, and why authorisation in middleware was a bad idea.
Check yourself