SOTA Web Frameworks (2026)

Purpose

This skill encodes the 2026 state of the art for the two dominant JavaScript SSR stacks — React + Next.js and Vue + Nuxt — and the server-rendering concerns they share. It is deliberately framework-specific: the traps that matter here (the RSC server/client boundary, Server Actions as public endpoints, hydration mismatches, SSR state leaking across requests, runtimeConfig/NEXT_PUBLIC_ secret boundaries) do not exist at the plain-language level.

Two modes:

• BUILD — writing or modifying components, routes, and data-fetching to this standard.
• AUDIT — reviewing an existing app and reporting findings.

Read SKILL.md fully; load rules/*.md on demand per the index below. Verify every version/CVE claim at use time — this file's facts were primary-sourced 2026-07 but framework security moves weekly (see the 2025-12 React Server Components RCE).