Future-Ready

A new WooCommerce migration tool pulls structured Shopify commerce data into WordPress's plugin-based rendering layer.

WebPulse scanned 9,947 of the world's most-visited domains. Next.js now powers 24.9% of detected frameworks. WordPress dropped to 22.4%. On the high-traffic web, the crossover has happened.

PHP's dominant framework carries a service boundary problem — and the static analysis tooling to map it is maturing.

Laravel CMS alternatives carry a structurally different CVE surface. WebPulse data maps the gap for budget signers.

A v22 patch fixes TypeScript rootDir failures — surfacing the enterprise cost of broken upgrade tooling

A tsconfig rootDir fix in v22.0.4 exposes migration machinery as a distinct cost layer in enterprise Angular estates

PHP's dominant framework now generates tooling to navigate its own architectural complexity

Dan Abramov's hire signals the React ecosystem consolidating around a single meta-framework

The CMS powering a third of the detected web publishes no versioned releases on GitHub, while Next.js, Astro, and Joomla each ship 40–50 per year.

The CMS detected on a third of scanned sites maintains the narrowest active contributor base of any major framework in WebPulse's dataset.

Two mature server-side frameworks with comparable scope diverge sharply on trailing-twelve-month vulnerability counts. The gap traces to architecture, not age.

Hugo: 0 CVEs ever. HTMX: 0 critical CVEs. What makes them attack-surface-free, and who should migrate to them.

Vapor Mode, React Compiler, Angular Signals — all three frameworks are abandoning the virtual DOM compromise.

Most enterprises run legacy CMS + modern frontend + API layer. The migration is not one-to-one. It is three-to-one.

Spring Framework's 54% critical+high rate is the highest severity concentration WebPulse tracks

9 critical CVEs, 14 disclosed in the last year. Enterprise Java shops face board-level pressure with no easy exit.

State-changing operations triggered by link clicks and browser prefetch. The RSC boundary is thinner than it looks.

WordPress and Laravel score 35 and 74 on AI-readiness. Django and FastAPI score 75 and 95. The language switch is not about syntax.

WordPress carries 18,321 CVEs and a security score of 25. The average breach costs $4.88M. Migration costs a fraction of that.

179 commits per year, 4 releases, activity score 40. Gatsby's community earned 56K stars. Its maintainers shipped 4 releases.

8.2 million legacy CMS sites face three distinct exit paths. The data shows which frameworks absorb the migration traffic.

Three frameworks with strong community enthusiasm and declining activity scores. Migration debt accumulates invisibly.

No commits detected from Remix or SvelteKit in the measurement window. Both score 47.0 activity.

2x the stars and 2x the commits of second place. The ecosystem is not competitive — it is gravitational.

Between April and June 2026, Spring's WebPulse security score dropped from 55.6 to 42.0 — the largest security decline of any tracked framework. Three coordinated CVEs in Spring Framework, the WebSphere triple exploit, and Oracle WebLogic advisories hit in the same window. Enterprise Java is under siege from every direction.

Between April and June 2026, SvelteKit's ecosystem score collapsed from 78 to 47 — the single largest dimensional decline of any tracked framework. Security stayed at 92. AI-readiness stayed at 85. But the dimension that measures real-world adoption momentum fell off a cliff.

After acquiring Astro, Cloudflare released EmDash — an open-source CMS on Astro 6 + Workers + D1. Each plugin runs in an isolated sandbox. No filesystem access. No database access. No PHP. The WordPress plugin model's central flaw is EmDash's founding design decision.

W3Techs data shows WordPress declining from 35.76% peak to 33.21%. But the share isn't going to Shopify or Wix — it's going to sites with no detectable CMS. Static generators and frameworks leave no fingerprint.

The enterprise hosting platform now manages legacy CMS and modern frameworks in a single operations layer. A signal that the migration is underway, not theoretical.

The infrastructure layer is absorbing the application layer. Cloudflare bought The Astro Technology Company, hired the entire team, and rebuilt Astro 6 on its own runtime. The framework stays MIT-licensed.

The CRA turns framework security from a best practice into a market access requirement. Unmaintained CMS plugins are now direct liability vectors.

China's first major cybersecurity law overhaul since 2017 applies to every web platform serving Chinese users. Vue.js dominates 45% of the Chinese web. Compliance tooling follows market share.

In 14 days, EU entities must pass their first NIS2 compliance audit (fines: €10M or 2% turnover), Spring Framework 6.2 loses all security patches (upgrade to Spring 7 requires Java 21), and Colorado's AI Act takes effect (the first comprehensive U.S. state AI law). No organization is ready for all three.

In 15 days, enterprises running Spring 6.2 lose open-source security patches on the same day the EU requires them to prove they have a patching strategy. Spring 7.0 is the upgrade path. The migration window is two weeks.

The fastest-growing major CMS in 2026 is not a developer framework. It is a no-code platform. WordPress + Shopify + Wix now control 73% of the CMS market. The middle tier is disappearing.

The math is unambiguous: modernization pays for itself. The execution is treacherous. AI-assisted migration reduces timelines by 4.5x — but only if the organization treats migration as engineering, not procurement.

Middleware bypass, SSRF, cache poisoning, XSS. Next.js 15.5.18 and 16.2.6 fixed them all in a coordinated release. The vulnerability count is real. The response model is what separates modern from legacy.

Security overhead and development time create a significant cost differential favoring static deployments among detected frameworks.

At 10 million sites scanned, legacy frameworks still outnumber modern ones nearly 5 to 1.

Angular holds 1.6% of the web — 165,015 detected sites. Enterprise telecom and manufacturing depend on it. But Angular's migration story is different from WordPress.

We modeled the 5-year cost of staying vs. migrating for 13 industries. The numbers surprise nobody who's done the math.

WebPulse scanned 10,002,735 sites. 8,250,594 run legacy frameworks. 1,752,141 run modern. The gap is the defining infrastructure challenge of this decade.

The EU's data protection law created the world's strictest compliance regime. European websites are still 75%+ legacy. The regulation didn't change the infrastructure.

1.4 billion people online. 69% of detected sites on WordPress. A digital economy growing at 10% annually on infrastructure from 2005.

Shopify already ate Drupal. Headless commerce is eating everything else. The migration math favors moving today, not next year.

Universities run Drupal and Rails — good choices in 2012. The web moved. They didn't. FERPA-protected student data sits on 15-year-old architecture.

The US federal government spent $100 billion on IT in 2025. A meaningful percentage of that maintains frameworks that stopped receiving security patches.

100% of top fintech companies run modern stacks. 0% run WordPress. The migration already happened in the industry that can't afford to get hacked.

The typical healthcare web stack scores 37/100 on security. The recommended stack scores 87/100. The compliance gap is a lawsuit waiting to happen.

Hugo: 0 CVEs, 0 plugins, 0 npm runtime dependencies, 0 supply chain attacks. In a year where both WordPress and npm ecosystems are under siege, static generators are the quiet winners.

11,334 CVEs vs. 3. $38,000/yr vs. $600/yr. The numbers behind the most impactful framework migration available today.

A diagnostic for organizational infrastructure health. If you can't answer these confidently, your stack needs attention.

Not a technical guide. A business playbook for the executives who approve the budget and the teams who execute the transition.

A modeled scenario based on published federal IT data and Drupal's actual EOL timeline.

A modeled migration scenario using published industry benchmarks. Every number is sourced or derived from our scoring data.