Start a new web app in 2026 and watch what you reach for. The framework is Next, or Nuxt, or SvelteKit. The components are shadcn/ui. Auth is Better Auth. The AI layer is an npm package named ai. The deploy target is Vercel. That list reads like a healthy ecosystem of independent tools. Every name on it is one company.
I went looking for receipts expecting to soften that claim. The dates checked out.
The buying started in 2021, and it started with people. Between August and December of that single year, Vercel hired the creator of webpack and the creator of swc, hired Rich Harris, who became the first person ever paid to work on Svelte full time, acquired Turborepo, and announced that Sebastian Markbåge, the architect of modern React, was leaving Meta too. The Svelte announcement carried a promise: the governance of the project “does not and will not change.”
The pace held. Andrew Clark, another React core member, left Meta for Vercel in 2023, and shadcn joined the same year. In July 2025 they bought NuxtLabs, which is to say Nuxt, Nitro, Sébastien Chopin, Daniel Roe, Pooya Parsa, and Anthony Fu. In July 2026 they bought Better Auth, nine months after Better Auth had itself absorbed Auth.js, the library a generation of us knew as NextAuth; the two together get pulled from npm about 13 million times a week.
They don’t own React, and they don’t own Vue. It hasn’t mattered. React’s own team page today lists eight Vercel engineers, including two of the seven seats on its Leadership Council, and when React moved into a foundation last October, Vercel was a founding member beside Meta, Microsoft, and Amazon. Dan Abramov joined this June. On the Vue side they bought the front door instead: Nuxt is how a huge share of the world uses Vue, and the maintainer of Vue Router and Pinia lists Vercel as his employer now. A framework can stay independent on paper while the hands that build it draw the same salary.
Standards are supposed to be the slow part of the web. Vercel doesn’t wait. Next.js declared React Server Components stable in May 2023, built on React’s canary channel, nineteen months before React itself shipped them stable in React 19. Next 13 made fetch() cache by default, overriding semantics the platform had already defined; two confused years later Next 15 flipped the default back, and the architect who designed the behavior wrote the apology. Middleware ran only on their Edge runtime, until the edge dream faded and Next 16 renamed middleware.ts to proxy.ts, on Node. None of it passed through a committee, and we migrated twice anyway. A standard is a decision other people can’t opt out of. Vercel has been writing those for years.
Sometimes the decision has a blast radius. In March 2025 researchers showed that one header, x-middleware-subrequest, let attackers skip Next.js middleware, auth checks included, severity 9.1 out of 10. The advisory contains a sentence I keep rereading: “Next.js deployments hosted on Vercel are automatically protected against this vulnerability.” The open framework was on fire and the fireproof room belonged to the vendor.
Running Next.js anywhere else was already its own genre of suffering. Netlify, which serves Next sites by the hundred thousand, described the build output as “a private, largely undocumented format that is subject to change”. SST built OpenNext to reverse-engineer deployment outside Vercel, Cloudflare and Netlify signed on, and an official adapter API arrived this March, three years in. Kent C. Dodds wrote it plainly back in 2023:
the line between Next.js and Vercel is very thin so if you’re not deploying on Vercel, you’re actually using a different framework from what’s documented
The harder power to see is taste. Vercel has its own typeface (Geist, open source, of course), a design system, and since last September a set of Web Interface Guidelines that ships with an AGENTS.md so AI agents can follow the house rules too. Fetch their design pages as a bot and you receive instructions written for the machine. Publishing taste as infrastructure, for people and for the models that write a growing share of our interfaces, is new.
Anthropic published Agent Skills last October, folders of instructions an agent loads mid-task, and made the format an open standard in December. By mid-January Vercel had built the registry: skills.sh, “the open agent skills ecosystem,” one leaderboard ranking everyone’s skills, Anthropic’s own included. The npx skills installer lists Guillermo Rauch, Vercel’s CEO, as a maintainer, and npm serves it about ten million times a week. Before January was out, Vercel’s own evals reported that a docs index pasted into AGENTS.md beat skills at their best, 100 percent to 79, on new Next.js APIs. The registry kept filling anyway. You don’t have to believe in a format to own its distribution.
They renamed the job while they were at it. “Design Engineer” existed long before Vercel, but they made it the title of the moment, hiring shadcn under it in 2023 and canonizing it in 2024. Somewhere right now a design engineer is building an interface in Next.js, styling it with components whose author Vercel employs, checking it against Vercel’s guidelines, in a typeface Vercel drew, and the news about what comes next will reach them at a conference Vercel runs for its own framework. Nobody forced any of it. The defaults were enough.
Investors priced Vercel at $3.25 billion in May 2024 and $9.3 billion sixteen months later; revenue passed a $340 million run rate this winter, and Rauch spent the spring making IPO noises. Developers pull Next from npm 53 million times a week, more than Vue, Svelte, and Nuxt combined. The ai package went from a curiosity to 22 million weekly downloads in two years, and AI agents, not people, now deploy 30 percent of new apps on the platform, by Rauch’s own telling. Vercel publishes market-share numbers for AI models measured from its own gateway traffic; they sit so close to the middle of the stack that their logs double as industry statistics.
Their CTO published an honest name for the strategy: framework-defined infrastructure. Whoever writes the framework decides what infrastructure the rest of us turn out to need, and each open-source line they fund makes leaving more expensive.
April showed what the concentration costs. One OAuth token, stolen from a third-party AI vendor, reached Vercel’s internal systems, and the attackers put customer data up for sale. The response was ordinary; the scale was the story. When one company fronts this much of the web, one token goes a long way.
The other side of the ledger keeps me honest. Before Vercel, almost nobody paid for any of this. Svelte was a side project, NextAuth ran on goodwill, Nuxt survived on a small company’s revenue and sponsor money, and we built billion-dollar products on top while chipping in pocket change. Vercel walked in and started writing salaries for work the rest of us consume free. Nobody stole the web. It sat for sale for twenty years, and one buyer showed up.
This site deploys to Cloudflare Pages, and I liked that it kept me a step outside the gravity. Then in June Cloudflare bought VoidZero, Evan You’s company behind Vite, the build tool under nearly every major framework except Next. The alternative to one giant is another giant.
Every acquisition arrives with the same sentence: nothing will change. The license stays MIT, the roadmap stays public, the maintainers keep their commit bits. I mostly believe it, the people involved strike me as sincere, and it unsettles me anyway, because nothing needs to change. Incentives don’t announce themselves, they tilt the floor a degree at a time, a hire here, a default there, a roadmap shaped by what deploys well on one cloud, until the open web is a feature of somebody’s platform and nobody can name the day it happened. This story has no villain. It has a buyer, patient and generous, and the rest of us at the counter, taking the deal.