Which framework should we use for a new web application in 2026?

It depends on who maintains it and which support line you need, not on which framework is trending. Svelte with SvelteKit gives the smallest client payload, which helps most where Interaction to Next Paint is under pressure. Angular v22 with signals and zoneless change detection is the strongest enterprise front-end case, on a yearly major cycle with a 24-month support window. ASP.NET Core on .NET 10 is right when the organisation already runs .NET and needs a long-term support line through November 2028. We write the constraints down first and let the choice fall out of them.

We are on .NET 8. What happens on 10 November 2026?

Both .NET 8 and .NET 9 reach end of support on that date, which means no further security patches. .NET 6 and .NET 7 are already unsupported. For most applications the move to .NET 10, the current long-term support release supported through November 2028, is a version migration rather than a rewrite, and it brings C# 14, built-in minimal API validation and OpenAPI 3.1 by default. Treating a supported-version upgrade as a rewrite is the most expensive mistake available here, so we scope the upgrade first and only discuss rearchitecting where there is a separate reason for it.

How do you handle a critical framework vulnerability like React2Shell?

React2Shell (CVE-2025-55182) was a CVSS 10.0 unauthenticated remote code execution flaw in the React Server Components Flight protocol, disclosed on 3 December 2025 with public exploits circulating from 4 December, and fixed across React 19.0.1, 19.1.2 and 19.2.1 plus seven Next.js patch lines. Our commitment is structural rather than heroic. You sit on a named support line, we tell you which one and until when, we track the vendor's security release cadence, and an emergency patch is a same-week deployment rather than a change request.

Do you use AI to write our code, and how is it reviewed?

Yes, where it earns its place, and you are told which components were AI-assisted and what review each received. Every AI-assisted change passes a named human reviewer before merge, with type checking and linting as CI gates and tests covering authentication, payment and data paths. The reason is measured. DORA's 2025 report finds 90% of technology professionals using AI at work and AI correlating positively with delivery throughput but still negatively with delivery stability, and Stack Overflow's 2025 survey of nearly 49,000 developers finds only 3% highly trusting AI output while 66% name almost-right AI solutions as their top frustration.

Will Core Web Vitals now measure our single-page application's route changes?

Increasingly, yes. Chrome 151 shipped soft navigations unflagged in July 2026, so JavaScript-driven route changes can now report Contentful Paint, Largest Contentful Paint, Cumulative Layout Shift and Interaction to Next Paint, which previously went unmeasured. A soft navigation requires a user-initiated action, a visible URL change and a visible paint, and web-vitals v6.0.0 and later supports it. How this will surface in the Chrome UX Report is still undetermined, so treat it as exposure that is coming rather than a scoring change that has already landed, and start measuring your own route transitions now.

Web Development Services in Svelte, Angular, ASP.NET Core and Node.js

Web development is the work of designing, building, operating and keeping current a web application that real people use in a browser. The building part is no longer where projects fail. Keeping it fast, patched, accessible and maintainable for three years is.

Almost everything about how a web application is compiled, rendered and reasoned about changed between 2024 and August 2026. The build toolchain was rewritten in Rust and Go. Signals replaced change-detection-by-default across frameworks. Server-driven rendering won the architecture argument and is now bolting single-page responsiveness back on top of itself rather than the other way round. A CVSS 10.0 remote code execution in React Server Components turned framework patch cadence into a procurement question. And two accessibility regimes attached real dates to work that used to be advisory.

Mixcore Studio has been building web software for 8+ years with a team of about 20, and has delivered 320+ projects. This page is about what we would actually recommend today, including the cases where the answer is not a custom build at all.

What changed in web development by August 2026

These are the shifts that change a technical decision, not the ones that only change a conference slide.

The toolchain went native — Vite 8, released 12 March 2026, replaced the old esbuild-for-dev plus Rollup-for-build split with Rolldown, a single Rust bundler. The Vite team reports build improvements up to 10-30x, with Linear going from 46 seconds to 6 seconds and Mercedes-Benz.io cutting build time 38%. TypeScript 7.0, released 8 July 2026, is a Go port of the compiler that the Microsoft TypeScript team measures at 7.7-11.9x on full builds, taking a full type check of the VS Code codebase from 125.7 seconds to 10.6 seconds. Turbopack is the default bundler in Next.js 16, and Rust linters, oxlint and Biome, are displacing ESLint and Prettier. "Our build is slow" stopped being an acceptable answer, because the tax is now optional.
Signals became the cross-framework consensus — Svelte 5 runes, Angular signals stable since v20, and zoneless change detection as the Angular default from v21 with zone.js fully optional in v22. Angular added ChangeDetectionStrategy.Eager and made OnPush the default. Code written to assume a framework re-checks everything on every event is now the legacy path.
Server-driven rendering won — the argument is settled, and the frameworks are adding single-page responsiveness back on top of server rendering rather than retreating to client-only apps. Next.js 16.3, released 3 August 2026, shipped Instant Navigations with partial prefetching for exactly this. SvelteKit does it with async server-side rendering and remote functions. Astro doubles down on islands. Client-only rendering for content, marketing and commerce is now the exception you have to argue for.
TypeScript won and simultaneously lost its build step — GitHub's Octoverse 2025 reports TypeScript passing both Python and JavaScript to become the most used language on GitHub for the first time. Meanwhile Node.js strips types natively, unflagged since v23.6.0 and stable since v25.2.0, as do Deno and Bun. The compiler's remaining job is the type-checking gate in CI, not producing runnable output.
The language itself moved — ECMAScript 2026 was approved by Ecma International in June 2026, landing Math.sumPrecise, Iterator.concat, Array.fromAsync and Error.isError. Temporal, the replacement for the Date object, and explicit resource management via using and await using both reached Stage 4 but are scheduled for ECMAScript 2027. Date handling code written against Date is the largest quiet refactor most codebases now carry.
The edge runtime era ended by consolidation — Vercel now recommends migrating off the Edge runtime to the Node.js runtime, with both running on Fluid compute, and from Next.js 16.3 setting runtime = 'edge' is no longer supported — routes and pages run on Node.js. Cloudflare Workers remains genuinely isolate-native. If you were sold "edge everything" in 2023 and accepted runtime constraints to get it, that trade is worth revisiting.

The stacks we build on, and how we choose between them

We work in five stacks, and the choice is made on your constraints rather than on our preference. Each has a page of its own in this section.

Svelte and SvelteKit — Svelte 5 on the 5.56.x line with runes as the mature default reactivity model, and SvelteKit on 2.69-2.70. Smallest client payload of the options here, which matters most where Interaction to Next Paint is under pressure. Note that SvelteKit 3 is in active prerelease — 3.0.0-next.23 was published on 13 August 2026 — and carries breaking changes, so it is a real migration rather than a version bump. We do not put a client production system on a prerelease. We do plan the upgrade now, because doing it cold in a year costs more.
Angular — v22, released 3 June 2026, is the strongest enterprise front-end argument it has had in years. Signal Forms, resource() and httpResource() are production-ready, Angular Aria's accessible headless component patterns are stable, and zoneless is the default. Two caveats you should hear before choosing it. The esbuild-based application builder has been the default since v17, and Vitest replaced Karma as the primary test runner in v21, so an older Angular application carries migration work beyond the version bump. Majors are now yearly with a 24-month window, 12 months active and 12 months long-term support, which makes upgrade budgeting predictable but non-optional.
ASP.NET Core and .NET — .NET 10, released 11 November 2025, is the current long-term support release, supported through November 2028, shipping with C# 14. ASP.NET Core 10 adds built-in minimal API validation returning automatic 400 responses, OpenAPI 3.1 by default with XML documentation integration, and passkey, WebAuthn and FIDO2 support in Identity. Blazor gained declarative state persistence and circuit resilience. This is the stack we recommend when the organisation already runs on .NET and the real requirement is a supported, auditable line rather than a novel one.
Node.js — v24 Krypton is the active long-term support line and enters maintenance on 20 October 2026, v26 becomes long-term support on 28 October 2026, and v22 is maintenance only until 30 April 2027. Node runs TypeScript directly now, but honestly, with limits worth knowing before you rely on it. Type stripping performs no type checking, ignores tsconfig.json, supports only erasable syntax, so enums, runtime namespaces, parameter properties and decorators all fail, and does not handle .tsx. It removes a build step. It does not remove the need for tsc in CI.
PHP, Laravel and Symfony — PHP 8.5, released 20 November 2025, added the pipe operator, clone with, a native URI extension and the NoDiscard attribute. Laravel 13 arrived 17 March 2026 requiring PHP 8.3 as a minimum, with bug fixes into Q3 2027 and security fixes into Q1 2028. On Symfony, 8.1 is current but reaches end of support in January 2027, while 7.4 is the long-term support release with bug fixes to November 2028. For a system that must sit still for four years, the Symfony 7.4 long-term support line is usually the better answer than the newest minor.
Plain ECMAScript — not every project needs a framework. A well-built server-rendered application with a few progressive enhancement islands, written against ES2026 and the modern platform, will outlive most framework choices and is far cheaper to keep patched.

A note on popularity as a selection criterion. The State of JavaScript 2025 survey of 11,411 respondents found Astro leading meta-framework satisfaction while Next.js leads usage, with a 39-point satisfaction gap between them and Next.js satisfaction declining year over year. Usage share and developer satisfaction have diverged. Neither one on its own is a reason to pick a framework for your project.

Patch cadence and end-of-support dates are now contract terms

In December 2025, React2Shell (CVE-2025-55182) was disclosed as an unauthenticated remote code execution flaw in the React Server Components Flight protocol, scored CVSS 10.0, with publicly available exploits circulating from 4 December 2025. Fixes landed across React 19.0.1, 19.1.2 and 19.2.1 and seven separate Next.js patch lines including 16.0.7. Nothing about a buyer's framework due diligence looked the same afterwards.

Vercel's response was structural. On 13 July 2026 it announced a Next.js Security Release Program with roughly monthly pre-announced security releases and advance notice of the highest expected severity in each; its first scheduled release covered patches for the 16.2 and 15.5 lines. The stated reason cites Mozilla disclosing 271 issues in a single Firefox release, all surfaced by AI-assisted vulnerability research. The volume of discovered vulnerabilities is going up because the discovery tooling improved, and that is now the baseline everyone plans around.

Three dates are worth writing into a plan today.

.NET 8 and .NET 9 both end support on 10 November 2026 — that is three months away and it affects a very large installed base. .NET 6 and .NET 7 are already unsupported. The upgrade to .NET 10 is usually a supported-version migration rather than a rewrite, and treating it as a rewrite is the most expensive mistake available here.
Node.js 22 reaches end of life on 30 April 2027 and Node 24 enters maintenance on 20 October 2026 — modern frameworks have already moved the floor. Next.js 16 requires Node 20.9 as a minimum and dropped Node 18. Vite 8 requires Node 20.19 or 22.12.
Framework majors now have published windows — Angular's 24-month cycle, Next.js's scheduled monthly security releases, Laravel and Symfony's published bug-fix and security horizons. "What will this cost me to keep running in three years" has a numeric answer, and we would rather give it to you at the first meeting than at the second renewal.

What we commit to in practice is the boring part: you sit on a named support line, we tell you which one and until when, and an emergency framework patch is a same-week deployment, not a change request.

Core Web Vitals and accessibility law set a pass mark

Two areas stopped being best practice and became measurable pass or fail conditions with dates on them.

Core Web Vitals thresholds are unchanged and specific — Largest Contentful Paint under 2.5 seconds, Interaction to Next Paint under 200 milliseconds, Cumulative Layout Shift under 0.1, assessed at the 75th percentile of real-user field data over a rolling 28-day window. A URL group needs 75% of real-user sessions rated Good to pass in Search Console. Interaction to Next Paint is the one that punishes JavaScript-heavy interaction, and it replaced First Input Delay back in March 2024.
Route changes are no longer invisible — Chrome 151, in July 2026, shipped soft navigations unflagged. Single-page applications now report Contentful Paint, Largest Contentful Paint, Cumulative Layout Shift and Interaction to Next Paint across JavaScript-driven route changes, which previously went unmeasured. web-vitals v6.0.0 and later supports it. How this will be reported in the Chrome UX Report is still undetermined, so treat it as exposure that is coming rather than a scoring change that has already landed.
The European Accessibility Act already applies — Directive (EU) 2019/882 has applied to newly marketed products and services since 28 June 2025, covering e-commerce, banking and financial services, e-books, passenger transport and self-service terminals. W3C notes it references WCAG 2.2. The separate EU Web Accessibility Directive 2016/2102 covers the public sector through EN 301 549, which incorporates WCAG 2.1 Level AA verbatim.
The US ADA Title II rule has hard deadlines — WCAG 2.1 Level AA by 26 April 2027 for state and local governments serving 50,000 or more people, and by 26 April 2028 for smaller entities and special district governments. Obligations extend to contractors delivering public services, which catches a lot of private vendors who assumed it did not apply to them.
WCAG 2.2 is the current W3C Recommendation — published 5 October 2023 and updated 12 December 2024. It does not supersede 2.1 or 2.0, and WCAG 3.0 remains an early working draft. An overlay widget is not conformance evidence. Keyboard traversal, focus visibility, target sizes, form error handling and tested screen reader behaviour are.

We build to WCAG 2.2 AA and give you the audit trail rather than a badge, and we measure Core Web Vitals from real-user field data rather than from a lab score, because the lab score is not what Search Console assesses.

How we use AI code generation, and what we verify

We use AI assistance, and we tell you where. Denying it is not credible in 2026, and buyers have stopped asking whether it was used. They ask who reviewed the output and what the tests cover.

The measured picture is consistent across two large independent surveys. DORA's 2025 State of AI-assisted Software Development report, drawing on around 5,000 technology professionals, finds 90% using AI at work and over 80% saying it increased their productivity, while 30% report little or no trust in AI-generated code. Its most important finding for a buyer is that AI adoption now correlates positively with software delivery throughput but continues to correlate negatively with delivery stability. The report's own summary line is that AI does not fix a team, it amplifies what is already there. The Stack Overflow 2025 Developer Survey of nearly 49,000 developers points the same way: 84% use or plan to use AI tools, only 3% highly trust the output, 66% name almost-right AI solutions as their top frustration, and 45% say debugging AI-generated code is more time-consuming.

A named human reviewer before merge — no AI-assisted change reaches your production branch without an engineer signing off on it by name.
Verification harness over headcount — the scarce role on a web team in 2026 is the senior reviewer and the automated test suite, not the person producing the first draft. That is where we put the hours.
Type checking as a CI gate — since runtimes now execute TypeScript without checking it, tsc in the pipeline is the thing standing between a type error and production.
Provenance you can audit — you are told which components were AI-assisted and what review each one received, because that is what your own security reviewer will ask.
Stability measured separately from speed — change failure rate and recovery time are tracked, not just delivery throughput, because the DORA data says those are the two that move in opposite directions.

When custom web development is the wrong choice

Some of the work described above should not be bought at all. We would rather say so before quoting than after.

A brochure site or a content-led marketing site — if the requirement is pages, a blog and a contact form, a hosted platform or a static site generator will serve you better and cheaper for years. A bespoke application framework here buys you a maintenance liability with no matching benefit.
A working system on a supported version — "modernising" software that is stable, patched and meeting its performance budget is usually value destruction. If you are on .NET 8, the honest scope is the .NET 10 upgrade before 10 November 2026, not a rewrite.
No budget for maintenance after launch — every framework here now has published support windows measured in months. If the project cannot fund upgrade work in years two and three, pick the most boring long-term support line available and accept fewer features, rather than a fast-moving stack you will abandon at the first breaking major.
Chasing a version number — the SvelteKit 3 prerelease is genuinely good and we are not putting your production system on it. Adopting a prerelease, or a compiler whose ecosystem has not caught up, is a cost you carry alone. TypeScript 7.0 ships without a programmatic API, with one planned for 7.1, which is why typescript-eslint and the Vue, Svelte and Astro template type-checkers cannot run on it yet. That gap is temporary and it is real today.
Single-page rendering by reflex — server rendering with islands is now the mainstream answer for content, commerce and marketing, and Interaction to Next Paint punishes the alternative. The honest counterpoint is that authenticated, app-like tools where the user stays for an hour are still a legitimate single-page case. It is the default that changed, not the technique.
Portability you have not asked about — if being able to move host matters, say so at the start. Adapters and platform bindings differ enough between Cloudflare, Netlify and Vercel that portability is a design decision with a cost, not a property you can add later.

What we bring to web development work

Server-Rendered Architecture
Signals-Based Front Ends
Rust And Go Toolchains
Framework Patch Response
WCAG 2.2 Conformance
Core Web Vitals Field Data

How we run a web development engagement

Four stages, in order. Stack selection comes after the constraints are written down, and the last stage is the one most proposals leave out. If a stage cannot be evidenced when it closes, we say so rather than moving on.

01

Constraints before stack

We write down the things that actually decide the technology. Who maintains it after launch, which support line it has to sit on, what accessibility regime applies, what the traffic and cost profile looks like, and whether you need to be able to change host later. The framework choice falls out of that list. Choosing first and justifying afterwards is how teams end up on a stack nobody can staff.
02

Server-rendered skeleton with a performance budget

We build the rendering path first, with explicit budgets for Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift, and a keyboard and screen reader pass on the same skeleton. Retrofitting either performance or accessibility onto a finished interface costs several times more than building against a budget from the start.
03

Reviewed build with the gate in place

AI assistance is used where it earns its place, with a named engineer reviewing before merge, type checking and linting as CI gates, and tests covering authentication, payment and data paths explicitly. You are told which components were AI-assisted and what review each received. Since runtimes now execute TypeScript without checking it, the CI type gate is not optional.
04

Field measurement and a patch plan

We measure Core Web Vitals from real-user field data over the 28-day window rather than from a lab score, and hand over a written upgrade plan naming your support line, its end-of-support date and the next scheduled major. Emergency framework patches are a same-week deployment. That commitment is worth more than any launch-day benchmark.

Frequently asked questions

Which framework should we use for a new web application in 2026?

It depends on who maintains it and which support line you need, not on which framework is trending. Svelte with SvelteKit gives the smallest client payload, which helps most where Interaction to Next Paint is under pressure. Angular v22 with signals and zoneless change detection is the strongest enterprise front-end case, on a yearly major cycle with a 24-month support window. ASP.NET Core on .NET 10 is right when the organisation already runs .NET and needs a long-term support line through November 2028. We write the constraints down first and let the choice fall out of them.
We are on .NET 8. What happens on 10 November 2026?

Both .NET 8 and .NET 9 reach end of support on that date, which means no further security patches. .NET 6 and .NET 7 are already unsupported. For most applications the move to .NET 10, the current long-term support release supported through November 2028, is a version migration rather than a rewrite, and it brings C# 14, built-in minimal API validation and OpenAPI 3.1 by default. Treating a supported-version upgrade as a rewrite is the most expensive mistake available here, so we scope the upgrade first and only discuss rearchitecting where there is a separate reason for it.
How do you handle a critical framework vulnerability like React2Shell?

React2Shell (CVE-2025-55182) was a CVSS 10.0 unauthenticated remote code execution flaw in the React Server Components Flight protocol, disclosed on 3 December 2025 with public exploits circulating from 4 December, and fixed across React 19.0.1, 19.1.2 and 19.2.1 plus seven Next.js patch lines. Our commitment is structural rather than heroic. You sit on a named support line, we tell you which one and until when, we track the vendor's security release cadence, and an emergency patch is a same-week deployment rather than a change request.
Do you use AI to write our code, and how is it reviewed?

Yes, where it earns its place, and you are told which components were AI-assisted and what review each received. Every AI-assisted change passes a named human reviewer before merge, with type checking and linting as CI gates and tests covering authentication, payment and data paths. The reason is measured. DORA's 2025 report finds 90% of technology professionals using AI at work and AI correlating positively with delivery throughput but still negatively with delivery stability, and Stack Overflow's 2025 survey of nearly 49,000 developers finds only 3% highly trusting AI output while 66% name almost-right AI solutions as their top frustration.
Will Core Web Vitals now measure our single-page application's route changes?

Increasingly, yes. Chrome 151 shipped soft navigations unflagged in July 2026, so JavaScript-driven route changes can now report Contentful Paint, Largest Contentful Paint, Cumulative Layout Shift and Interaction to Next Paint, which previously went unmeasured. A soft navigation requires a user-initiated action, a visible URL change and a visible paint, and web-vitals v6.0.0 and later supports it. How this will surface in the Chrome UX Report is still undetermined, so treat it as exposure that is coming rather than a scoring change that has already landed, and start measuring your own route transitions now.