Start a new web app in 2026 and watch what you reach for. The framework is Next, or Nuxt, or SvelteKit. The components are shadcn/ui. Auth is Better Auth. The AI layer is an npm package named ai. The deploy target is Vercel. That list looks like an ecosystem of independent tools, and every name on it answers to one company.
I went looking for receipts expecting to soften that claim. The dates checked out.
The buying started in 2021, and it started with people. Between August and December of that one year, Vercel hired the creator of webpack and the creator of swc, hired Rich Harris, who became the first person ever paid to work on Svelte full time, acquired Turborepo, and announced that Sebastian Markbåge, the architect of modern React, was leaving Meta too. The Svelte announcement carried a promise: the governance of the project “does not and will not change.”
The pace held. Andrew Clark, another React core member, left Meta for Vercel in 2023, and shadcn joined the same year. In July 2025 they bought NuxtLabs, which is to say Nuxt, Nitro, Sébastien Chopin, Daniel Roe, Pooya Parsa, and Anthony Fu. In July 2026 they bought Better Auth, nine months after Better Auth had itself absorbed Auth.js, the library a generation of us knew as NextAuth. The two together get pulled from npm about 13 million times a week.
They don’t own React, and they don’t own Vue. It hasn’t mattered. React’s own team page today lists eight Vercel engineers, including two of the seven seats on its Leadership Council, and when React moved into a foundation last October, Vercel was a founding member beside Meta, Microsoft, and Amazon. Dan Abramov joined this June. On the Vue side they bought the front door instead: Nuxt is how a huge share of the world uses Vue, and the maintainer of Vue Router and Pinia lists Vercel as his employer now. Both projects are still independent, and the people who build them are on one payroll.
Standards are supposed to be the slow part of the web. Vercel doesn’t wait. Next.js declared React Server Components stable in May 2023, built on React’s canary channel, nineteen months before React itself shipped them stable in React 19. Next 13 made fetch() cache by default, overriding semantics the platform had already defined; two confused years later Next 15 flipped the default back, and the architect who designed the behavior wrote the apology. Middleware ran only on their Edge runtime, until the edge dream faded and Next 16 renamed middleware.ts to proxy.ts, on Node. None of it passed through a committee. We migrated twice anyway.
In March 2025 researchers showed that one header, x-middleware-subrequest, let attackers skip Next.js middleware, auth checks included, at severity 9.1 out of 10. The advisory contains a sentence I keep rereading: “Next.js deployments hosted on Vercel are automatically protected against this vulnerability.”
Running Next.js anywhere else was already hard work. Netlify, which serves Next sites by the hundred thousand, described the build output as “a private, largely undocumented format that is subject to change”. SST built OpenNext to reverse-engineer deployment outside Vercel, Cloudflare and Netlify signed on, and an official adapter API arrived this March, three years in. Kent C. Dodds wrote it plainly back in 2023:
the line between Next.js and Vercel is very thin so if you’re not deploying on Vercel, you’re actually using a different framework from what’s documented
The harder power to see is taste. Vercel has its own typeface (Geist, open source, of course), a design system, and since last September a set of Web Interface Guidelines that ships with an AGENTS.md so AI agents can follow the house rules too. Fetch their design pages as a bot and you receive instructions written for the machine. Publishing taste that way, for people and for the models that write a growing share of our interfaces, is new.
Anthropic published Agent Skills last October, folders of instructions an agent loads mid-task, and made the format an open standard in December. By mid-January Vercel had built the registry: skills.sh, “the open agent skills ecosystem,” one leaderboard ranking everyone’s skills, Anthropic’s own included. The npx skills installer lists Guillermo Rauch, Vercel’s CEO, as a maintainer, and npm serves it about ten million times a week. Before January was out, Vercel’s own evals reported that a docs index pasted into AGENTS.md beat skills at their best, 100 percent to 79, on new Next.js APIs. The registry kept filling anyway.
They renamed the job while they were at it. “Design Engineer” existed long before Vercel, and they made it the title of the moment, hiring shadcn under it in 2023 and canonizing it in 2024. Somewhere right now a design engineer is building an interface in Next.js, styling it with components whose author Vercel employs, checking it against Vercel’s guidelines, in a typeface Vercel drew, and the news about what comes next will reach them at a conference Vercel runs for its own framework. Nobody forced any of it. The defaults were enough.
Investors priced Vercel at $3.25 billion in May 2024 and $9.3 billion sixteen months later. Revenue passed a $340 million run rate this winter, and Rauch spent the spring making IPO noises. Developers pull Next from npm 53 million times a week, more than Vue, Svelte, and Nuxt combined. The ai package went from a curiosity to 22 million weekly downloads in two years, and AI agents, not people, now deploy 30 percent of new apps on the platform, by Rauch’s own telling. Vercel publishes market-share numbers for AI models measured from its own gateway traffic; they sit close enough to the middle of the stack that their logs double as industry statistics.
Their CTO published an honest name for the strategy: framework-defined infrastructure. Whoever writes the framework decides what infrastructure the rest of us turn out to need, and each open-source line they fund makes leaving more expensive.
April showed what the concentration costs. One OAuth token, stolen from a third-party AI vendor, reached Vercel’s internal systems, and the attackers put customer data up for sale. The response was ordinary. What made it worth writing down is how many companies sat behind that one token.
The other side of the ledger keeps me honest. Before Vercel, almost nobody paid for any of this. Svelte was a side project, NextAuth ran on goodwill, and Nuxt survived on a small company’s revenue and sponsor money, while we built billion-dollar products on top and chipped in pocket change. Vercel walked in and started writing salaries for work the rest of us consume free. Nobody stole the web. It sat for sale for twenty years, and one buyer showed up.
This site deploys to Cloudflare Pages, and I liked that it kept me a step outside the gravity. Then in June Cloudflare bought VoidZero, Evan You’s company behind Vite, the build tool under nearly every major framework except Next. I had moved sideways.
Every acquisition arrives with the same sentence: nothing will change. The license stays MIT, the roadmap stays public, the maintainers keep their commit bits. I mostly believe it, and the people involved strike me as sincere. It unsettles me anyway, because nothing needs to change. A hire here, a default there, a roadmap shaped by what deploys well on one cloud. Five years of that is the list at the top of this page.