sota-web-frameworkslisted
State-of-the-art engineering rules (2026) for the JavaScript SSR meta-frameworks: React 19 + Next.js (App Router, React Server Components, Server Actions) and Vue 3 + Nuxt 4 (Nitro server routes, composables) — plus the cross-cutting concerns of server rendering: hydration correctness, SSR state serialization, the server/client trust boundary, and framework-specific security and CVEs. Use when building or auditing any React/Next or Vue/Nuxt app — components, RSC/client boundaries, Server Actions or Nitro routes, data fetching and caching, hydration mismatches, SSR/SSG/ISR strategy, or framework CVE exposure. Complements sota-javascript-typescript, sota-frontend-design, sota-code-security, and sota-performance. Trigger keywords: React, Next.js, App Router, React Server Components, RSC, Server Actions, use client, use server, Vue, Nuxt, Nitro, Pinia, composable, script setup, SSR, hydration, hydration mismatch, use cache, PPR, ISR, proxy.ts, middleware, useFetch, useState, runtimeConfig, CSP nonce, devalue.
martinholovsky/SOTA-skills · ★ 8 · Web & Frontend · score 75
Install: claude install-skill martinholovsky/SOTA-skills
# SOTA Web Frameworks (2026)
## Purpose
This skill encodes the 2026 state of the art for the two dominant JavaScript SSR
stacks — **React + Next.js** and **Vue + Nuxt** — and the server-rendering concerns
they share. It is deliberately framework-specific: the traps that matter here
(the RSC server/client boundary, Server Actions as public endpoints, hydration
mismatches, SSR state leaking across requests, `runtimeConfig`/`NEXT_PUBLIC_`
secret boundaries) do not exist at the plain-language level.
Two modes:
- **BUILD** — writing or modifying components, routes, and data-fetching to this standard.
- **AUDIT** — reviewing an existing app and reporting findings.
Read SKILL.md fully; load `rules/*.md` on demand per the index below. **Verify every
version/CVE claim at use time** — this file's facts were primary-sourced 2026-07 but
framework security moves weekly (see the 2025-12 React Server Components RCE).
## Scope boundaries (what lives elsewhere)
This skill stacks *on top of* the general skills — load them together, don't duplicate:
- **`sota-javascript-typescript`** — strict `tsconfig`, type design, promises,
Node hardening, npm supply chain. The *language*; this skill is the *framework*.
- **`sota-frontend-design`** — visual design, layout, components-as-UX, WCAG 2.2
accessibility, motion. This skill covers component *engineering*, not *design*.
- **`sota-code-security`** — generic XSS/CSRF/SSRF/authn/authz/crypto theory. This
skill covers the *framework-specifi