React, Next.js, and TypeScript ruled the last decade. But in 2026, the web is fighting back and frameworks might be losing.
A NEW JAVASCRIPT FRAMEWORK IS BORN EVERY SIX MONTHS About once every twelve, a dev on Twitter speaks up and denounces the old as dead. But this time? It’s not just hot air.
Something real is on the move and when you are still turning to a full React setup for your blog or landing page, you might very much be using yesterday’s problem to solve yesterday’s problems with yesterday’s tools.
The Framework Fatigue Is Real
Remember when React felt revolutionary? How bout when Redux state management made it feel like you finally grew up as a developer? And that period came at a price which we are only just now paying.
The average React app shipping to render “Hello World” in 2024 ships ~150KB of JavaScript
The Session I Missed Scared Me the Most
This is an unconference. You propose topics, they get slotted, and inevitably two things you care about land in the same slot. I proposed a session, it ran opposite the one on security, and I can’t be in two rooms at once. So I picked mine and missed the security one. Too bad, I’d have liked to be there.
Because people came out of that room rattled. Not junior folks looking for something to worry about – some of the most senior, most seen-it-all people at the whole retreat, the kind who don’t spook easily. They walked out saying, more or less, that they were terrified. And when those people use that word, you pay attention.
I wasn’t in the room, so I won’t pretend to relay the specifics. But I don’t need the transcript to connect the dots. Think about everything above: agents writing the code, code as a disposable artifact regenerated on demand, a probabilistic thing making a thousand decisions a second that no human reads line by line. Now put an adversary in front of that. The attack surface isn’t your code anymore – it’s your spec, your prompts, the agent skills, your knowledge layer, your agents’ tool access, the supply chain feeding all of it. We are wiring autonomous, non-deterministic systems straight into production, and the security models we lean on were built for a world where a human wrote and reviewed every line.
So yeah. Count me terrified too.
The answer isn’t to panic, it’s to do the work. The game of running your own pen tests, red-teaming your own systems, attacking your own stuff before someone else does – that game just got a whole lot more real. If agents can build at this speed, agents can break at this speed, and you had better be the one pointing them at your own defenses first. This stops being a specialist’s job you outsource periodically and becomes something you bake into the loop, continuously. I don’t think most of us are anywhere near ready for that.