Innovation & Growth

Reflect Orbital's satellite drew astronomer objections. Its public site runs Astro, a framework with no recorded CVEs in the National Vulnerability Database.

v22.0.6 fixes a compiler type-checking edge case; NVD lists six Angular CVEs, zero critical, zero CISA KEV entries.

On the broader web, 58.3% of detected frameworks are legacy. On the top 10K, that drops to 43.9%. Modern frameworks hold 48.7% of the high-traffic web. The generation split is a function of traffic tier.

Next.js, Angular, Laravel, Vue, Remix, FastAPI, Astro, and HTMX all shipped updates in the same seven-day window — the update burden is the product

39 patch releases in 21 months — manageable with dependency automation, a recurring budget event without it

Rolldown's rejection of the Rust React Compiler reveals the infrastructure cost of React's optimization layer — before a single request is served.

Zero CVEs, zero build steps, 44K+ stars — hypermedia-driven development hits a major milestone

SaaS Pegasus drops its paywall, Wagtail challenges Django Admin, and the ecosystem signals a licensing inflection point

Three major frameworks pushed releases in 48 hours — while WordPress's last GitHub release remains at zero

Commits per contributor reveals which frameworks are overextended, which are coasting, and which have the engineering depth to respond when it matters.

Contributor density — contributors per 100,000 stars — reveals which frameworks have sustainable engineering and which are running on reputation.

Django, Laravel, Astro, Flask, FastAPI, Gatsby, and Hugo share a common trait that legacy CMS platforms lack.

The most active framework by raw output also holds 140K stars and a score of 90. Velocity compounds.

Angular, Django, FastAPI, Hugo, and 8 others carry zero CISA Known Exploited Vulnerabilities entries

The highest contributor density of any framework. More contributors per star than Next.js, Nuxt, or Astro.

CVE-2026-48019 and CVE-2026-4809 disclosed and resolved in a single release cycle — centralized maintenance at work.

By refusing to be a framework, HTMX refused to accumulate the attack surface that frameworks carry.

dj_queue, Djevops, and SeedBase shipped in the same week — community investment that maps to framework longevity.

Content-first architecture, 335 contributors, and a score of 90. Astro grows by consensus, not controversy.

The zero-JS-by-default framework is now the fastest-growing in the WebPulse dataset by download velocity. Server Islands and content-first architecture are pulling adoption from both legacy CMS and SPA-heavy stacks.

A 95-scoring backend, a 90-scoring frontend, and a headless CMS. Greenfield projects have a new center of gravity.

Vue's full-stack framework has more GitHub stars than three established server-side frameworks. Stars are attention.

Gatsby still has 55,940 GitHub stars. Astro passed it with 60,321 and ships 16x more commits per year.

39 total CVEs. Zero critical. Zero high. What happens when a framework learns from two decades of PHP mistakes.

In WebPulse's June 2026 scoring, Hugo became the first framework to achieve a 100.0 security score. The reason is simple: the NVD contains zero CVEs for Hugo across its entire history. No vulnerabilities have ever been reported. Here is why that is architecturally inevitable.

WebPulse cross-referenced GitHub PR merge speed with overall framework scores across 14 frameworks. The correlation is clear: frameworks that merge PRs in under 2 days score 73+. Frameworks that take weeks score below 70. Velocity is a health signal.

Svelte grew from 5% awareness in 2023 to 12% in 2026. The compiler-first framework eliminates the runtime overhead that React, Vue, and Angular are now racing to minimize.

AI-powered development tools are being built exclusively for modern framework ecosystems. Legacy frameworks get plugins. Modern frameworks get platform-level AI integration.

React's new compiler automatically optimizes component rendering, eliminating the useMemo and useCallback boilerplate that developers have fought for years.

Angular drops Zone.js for explicit Signals and standalone components. Teams report 18% bundle reduction and 12% faster initial loads. The framework convergence continues.

9 consecutive years as the most loved language. Senior Rust engineers earn $185K–$230K. US government mandates for memory-safe languages are accelerating enterprise adoption.

Next.js optimizes every millisecond of render time while its npm dependency tree remains the single largest attack surface in modern web development.

Arriving July 2026, npm v12 kills the attack vector behind Miasma, Shai-Hulud, Atomic Arch, and every preinstall-hook worm of the last decade. Dependencies will no longer execute code during installation unless explicitly allowed. Three breaking changes. One architectural decision. The npm supply chain era may be ending.

Anthropic, AWS, GitHub, Google, Microsoft, and OpenAI funded the grant. Alpha-Omega and OpenSSF will deploy it. But $12.5 million across an ecosystem supporting trillions of dollars in economic activity is a rounding error — and the supply chain attacks keep coming.

Fox Corporation's acquisition of Roku gives the media giant 85 million active accounts, a connected TV operating system, and direct control over the ad-supported streaming pipeline. Content companies are no longer licensing infrastructure. They are acquiring it. The web is consolidating around vertically integrated stacks.

Google's page experience signals directly affect search rankings. WordPress's 36% mobile pass rate means two-thirds of WordPress sites are penalized in search. Modern frameworks routinely achieve 90%+ pass rates.

Angular 22 defaults to zoneless signals. Vue 3.6 Vapor Mode eliminates the virtual DOM with 97% faster renders. Svelte has never had one. The architectural paradigm that defined a decade of frontend development is being replaced.

Every June 2026 vulnerability requires a runtime server, with Drupal and WordPress facing critical issues.

An unauthenticated API endpoint in ServiceNow exposed customer data across enterprise deployments. 'Move to SaaS' is not the same as 'move to secure.' The API surface is the new perimeter.

Microsoft's June 2026 Patch Tuesday shattered records — 206 vulnerabilities, 33 critical, a wormable kernel flaw. The driver: AI-assisted vulnerability discovery is producing an order of magnitude more findings than human-only research.

CVE-2026-42897. Actively exploited zero-day in Exchange Server — spoofing and cross-site scripting affecting Subscription Edition, 2016, and 2019. Organizations still running on-premise Exchange are running on borrowed time.

Laravel v13.15.0 continues a release cadence that outpaces most modern framework competitors.

100,000+ GitHub stars, Google-backed, and deployed across more enterprise applications than any competitor.

Astro — the framework with the highest WebPulse score — was acquired by the company that handles 20% of all web traffic. Infrastructure is voting.

96.3% of home pages have accessibility errors. Modern frameworks with semantic HTML defaults produce fewer violations by architecture. The accessibility case for modern frameworks that nobody is measuring.

The DNS provider is a proxy for the entire technology stack. Netlify/Vercel DNS predicts Jamstack. GoDaddy/Bluehost predicts WordPress. A new detection dimension hiding in plain sight.

High-GDP tech hubs modernize fastest. Aid-dependent economies follow institutional Drupal. Middle-income countries default to WordPress freelance economics. The framework map IS the economic map.

.ua: 33,568 detected. WordPress 61%, Joomla 12%, Drupal 8.5%, Angular 6%, Next.js 5.5%. Despite everything, Ukraine's web infrastructure is among the most diverse in Eastern Europe.

No 'NextConf.' No branded swag culture. Yet 242,905 detections — #4 overall, #1 modern. More than Angular, React, Vue, and Nuxt combined. The framework that won by being the obvious choice.

987 detected .dz sites. WordPress 69%, Angular 16%, Joomla 8%, Next.js 5.5%. Algeria joins the global Angular enterprise belt — a directional signal from North Africa's institutional web.

The TLD for social platforms and communities runs 36% Django — the highest Django rate of any TLD. When building social features, developers reach for Python.

React and Next.js get the conference talks. Vue quietly built a 41% share on .xyz — the Web3/crypto TLD with 15,330 detected sites. The framework map has a shadow layer.

1,328 detected .do sites. WordPress is 71%, but Angular at 15% is the second-highest Angular rate in the Americas. Caribbean enterprise infrastructure on Angular.

1,002 detected .kg sites. WordPress is 59%, but 19% Angular and 12% Django make Kyrgyzstan the world's highest Django adoption rate. Central Asia is more modern than Western Europe.

The TLD adopted by gaming communities runs 33% Nuxt.js, 17% Angular, 17% Rails. WordPress is only 25%. Gamers chose the stack gamers would choose.

.blog is 99% WordPress. .dev is 54% Next.js. .store is 59% Shopify. .gov is 49% Drupal. The TLD you chose predicts your entire technology stack.

Only 28% WordPress. 28% Drupal. 16% Shopify. 10% Rails. 7% Angular. 6% React. No other country comes close to this framework diversity.

The TLD developers buy for personal projects and side hustles. No client requests, no procurement defaults. Pure developer preference.

The highest SvelteKit adoption rate of any country. Plus 6.5% Angular. Central European dev culture is more diverse than the WordPress default.

24% Next.js on .kz domains vs 1% on .de. Less legacy means less inertia. The countries with the least to protect are moving fastest.

38,342 Vue ecosystem detections vs 16,703 standalone React. But apples-to-apples, React + Next.js dwarfs Vue + Nuxt. The framing changes everything.

At 6.28M, Django led Squarespace. At 10M detections, Squarespace has 53,500 vs Django's 40,151. Scale reversed the finding. The long tail favors platforms.

Among detected .cn domains, Vue.js + Nuxt.js together rank in the top 3. Cultural connections shaped technology adoption patterns.

Among 5,901 detected .kr domains, Korean web development culture shows unusual diversity. Enterprise JavaScript frameworks have a stronger foothold than anywhere else in Asia.

15 enterprise sites scanned: Next.js 6, Drupal 5, WordPress 3, Spring 2, React 2. No consensus. No standard. Every company chose differently.

While every industry debates WordPress vs Next.js, telecom quietly built on Angular and Vue. A completely different technology decision for completely different reasons.

28 major media sites scanned globally. WordPress: 14. Next.js: 14. A small but striking sample that suggests an industry mid-migration.

Spotify and Klarna run Next.js. But .se is 86% WordPress, .nl is 83%, .dk is 78%. The EU's digital divide isn't North vs South — it's funded tech vs everything else.

We scanned tech.gov.sg and gov.sg. Both run Next.js. Singapore proves modern government infrastructure is achievable.

PhonePe, CRED, Groww — we scanned them. Every Indian fintech runs modern frameworks. The UPI ecosystem enforces quality.

Wise, Monzo, Starling — we scanned them all. Every single UK fintech runs Next.js. Not one runs legacy CMS.

We scanned india.gov.in and whitehouse.gov. India modernized. The US didn't. The data is in our scanner.

The EU's digital sovereignty agenda collides with the reality that most European web infrastructure runs on US-built frameworks and platforms.

The region's most successful digital companies chose modern frameworks. Not one runs legacy CMS. The market is sending a signal.

Revolut, Wise, Monzo, Starling — the UK's fastest-growing financial companies all chose modern frameworks. Not one runs legacy CMS.

GOV.UK is the gold standard for digital government. Built on modern infrastructure, designed for citizens, not bureaucrats. Here's what makes it different.

Original research: Next.js at 42%, WordPress at 16%, legacy vs modern at 30% vs 70%. The shift has happened.

Edge computing changed the economics of web infrastructure. Legacy frameworks can't take advantage. Modern ones were built for it.

The companies born in the AI era didn't inherit legacy. They chose from scratch. Here's what they chose and why.

Performance gains, cost reduction, developer velocity, security improvement — quantified across real migrations.

The companies building the web's infrastructure made deliberate framework decisions. Here's the business logic behind each one.

Framework adoption varies dramatically by region. Developing markets are most dependent on the web's most vulnerable infrastructure.

BBC, Stripe, Cloudflare, Notion — we scanned 25 major sites. Here's what they chose.