Munawwar Firoz
munawwar.bsky.social
Munawwar Firoz
@munawwar.bsky.social
Web developer - HTML / CSS / JS, node.js, preact, vanilla JS, serverless, serverful, databases, IaC

github.com/Munawwar | codepasta.com

At Carriyo, Dubai, UAE
Pinned
Announcing Preact Combobox

- Multi-select & Single-select modes
- Partial word matching, accent matching
- Lazy options loading and remote search support
- Light / Dark theme, RTL, Translation, form submit support

www.npmjs.com/package/prea...
Me defending dom diffing
January 21, 2026 at 6:25 AM
Someday you'll be able to reprogram your own brain.

And people will vibe code it in --dangerously-skip-permissions mode and brick themselves.
January 16, 2026 at 4:23 PM
Reposted by Munawwar Firoz
We just released the Astro 6 beta. This is the result of the biggest refactor we've done to Astro since its early days. If you're interested in looking under the hood of a framework, stick with me and I'll explain what we did.

bsky.app/profile/astr...
Introducing the Astro 6.0 Beta.

- Redesigned dev server: run against the same runtime you deploy to
- First-class Cloudflare Workers support with workerd
- Stable Content Security Policy and Live Collections

It's never been a beta time to try Astro 👀
January 13, 2026 at 10:46 PM
FB Hermes / React Native team really cooked

That's a 75 kb HTML being rendered in 9ms by preact inside of a custom 5 MB JS binary I compiled via static hermes, running on ARM AWS lambda
January 4, 2026 at 6:39 PM
On AWS lambda, the hello world cold start of static hermes + web apis runtime I implemented on top¹ is same as go lang (compared w/ maxday perf). 🚀

Binary size = 3.5 MB (zip pkg = 1.6 MB 🤏).

¹ I disabled full unicode support and I added crypto APIs with libssl. If you disable that it's even faster
January 3, 2026 at 7:40 AM
I got a preact SSR bundle compiled to binary, using Static Hermes compiler, that can then be used to SSR from any language.

And it's *fast*.

3 ms cold start, 0.2 ms warm.

github.com/Munawwar/sta...
GitHub - Munawwar/static-hermes-ssr
Contribute to Munawwar/static-hermes-ssr development by creating an account on GitHub.
github.com
January 1, 2026 at 1:10 PM
Reposted by Munawwar Firoz
Package managers keep using git as a database, it never works out.

https://nesbitt.io/2025/12/24/package-managers-keep-using-git-as-a-database.html
Package managers keep using git as a database, it never works out
Using git as a database is a seductive idea. You get version history for free. Pull requests give you a review workflow. It’s distributed by design. GitHub will host it for free. Everyone already knows how to use it. Package managers keep falling for this. And it keeps not working out. ## Cargo The crates.io index started as a git repository. Every Cargo client cloned it. This worked fine when the registry was small, but the index kept growing. Users would see progress bars like “Resolving deltas: 74.01%, (64415/95919)” hanging for ages, the visible symptom of Cargo’s libgit2 library grinding through delta resolution on a repository with thousands of historic commits. The problem was worst in CI. Stateless environments would download the full index, use a tiny fraction of it, and throw it away. Every build, every time. RFC 2789 introduced a sparse HTTP protocol. Instead of cloning the whole index, Cargo now fetches files directly over HTTPS, downloading only the metadata for dependencies your project actually uses. (This is the “full index replication vs on-demand queries” tradeoff in action.) By April 2025, 99% of crates.io requests came from Cargo versions where sparse is the default. The git index still exists, still growing by thousands of commits per day, but most users never touch it. ## Homebrew GitHub explicitly asked Homebrew to stop using shallow clones. Updating them was “an extremely expensive operation” due to the tree layout and traffic of homebrew-core and homebrew-cask. Users were downloading 331MB just to unshallow homebrew-core. The .git folder approached 1GB on some machines. Every `brew update` meant waiting for git to grind through delta resolution. Homebrew 4.0.0 in February 2023 switched to JSON downloads for tap updates. The reasoning was blunt: “they are expensive to git fetch and git clone and GitHub would rather we didn’t do that… they are slow to git fetch and git clone and this provides a bad experience to end users.” Auto-updates now run every 24 hours instead of every 5 minutes, and they’re much faster because there’s no git fetch involved. ## CocoaPods CocoaPods is the package manager for iOS and macOS development. It hit the limits hard. The Specs repo grew to hundreds of thousands of podspecs across a deeply nested directory structure. Cloning took minutes. Updating took minutes. CI time vanished into git operations. GitHub imposed CPU rate limits. The culprit was shallow clones, which force GitHub’s servers to compute which objects the client already has. The team tried various band-aids: stopping auto-fetch on `pod install`, converting shallow clones to full clones, sharding the repository. The CocoaPods blog captured it well: “Git was invented at a time when ‘slow network’ and ‘no backups’ were legitimate design concerns. Running endless builds as part of continuous integration wasn’t commonplace.” CocoaPods 1.8 gave up on git entirely for most users. A CDN became the default, serving podspec files directly over HTTP. The migration saved users about a gigabyte of disk space and made `pod install` nearly instant for new setups. ## Go modules Grab’s engineering team went from 18 minutes for `go get` to 12 seconds after deploying a module proxy. That’s not a typo. Eighteen minutes down to twelve seconds. The problem was that `go get` needed to fetch each dependency’s source code just to read its go.mod file and resolve transitive dependencies. Cloning entire repositories to get a single file. Go had security concerns too. The original design wanted to remove version control tools entirely because “these fragment the ecosystem: packages developed using Bazaar or Fossil, for example, are effectively unavailable to users who cannot or choose not to install these tools.” Beyond fragmentation, the Go team worried about security bugs in version control systems becoming security bugs in `go get`. You’re not just importing code; you’re importing the attack surface of every VCS tool on the developer’s machine. GOPROXY became the default in Go 1.13. The proxy serves source archives and go.mod files independently over HTTP. Go also introduced a checksum database (sumdb) that records cryptographic hashes of module contents. This protects against force pushes silently changing tagged releases, and ensures modules remain available even if the original repository is deleted. ## Beyond package managers The same pattern shows up wherever developers try to use git as a database. Git-based wikis like Gollum (used by GitHub and GitLab) become “somewhat too slow to be usable” at scale. Browsing directory structure takes seconds per click. Loading pages takes longer. GitLab plans to move away from Gollum entirely. Git-based CMS platforms like Decap hit GitHub’s API rate limits. A Decap project on GitHub scales to about 10,000 entries if you have a lot of collection relations. A new user with an empty cache makes a request per entry to populate it, burning through the 5,000 request limit quickly. If your site has lots of content or updates frequently, use a database instead. Even GitOps tools that embrace git as a source of truth have to work around its limitations. ArgoCD’s repo server can run out of disk space cloning repositories. A single commit invalidates the cache for all applications in that repo. Large monorepos need special scaling considerations. ## The pattern The hosting problems are symptoms. The underlying issue is that git inherits filesystem limitations, and filesystems make terrible databases. **Directory limits.** Directories with too many files become slow. CocoaPods had 16,000 pod directories in a single Specs folder, requiring huge tree objects and expensive computation. Their fix was hash-based sharding: split directories by the first few characters of a hashed name, so no single directory has too many entries. Git itself does this internally with its objects folder, splitting into 256 subdirectories. You’re reinventing B-trees, badly. **Case sensitivity.** Git is case-sensitive, but macOS and Windows filesystems typically aren’t. Check out a repo containing both `File.txt` and `file.txt` on Windows, and the second overwrites the first. Azure DevOps had to add server-side enforcement to block pushes with case-conflicting paths. **Path length limits.** Windows restricts paths to 260 characters, a constraint dating back to DOS. Git supports longer paths, but Git for Windows inherits the OS limitation. This is painful with deeply nested node_modules directories, where `git status` fails with “Filename too long” errors. **Missing database features.** Databases have CHECK constraints and UNIQUE constraints; git has nothing, so every package manager builds its own validation layer. Databases have locking; git doesn’t. Databases have indexes for queries like “all packages depending on X”; with git you either traverse every file or build your own index. Databases have migrations for schema changes; git has “rewrite history and force everyone to re-clone.” The progression is predictable. Start with a flat directory of files. Hit filesystem limits. Implement sharding. Hit cross-platform issues. Build server-side enforcement. Build custom indexes. Eventually give up and use HTTP or an actual database. You’ve built a worse version of what databases already provide, spread across git hooks, CI pipelines, and bespoke tooling. None of this means git is bad. Git excels at what it was designed for: distributed collaboration on source code, with branching, merging, and offline work. The problem is using it for something else entirely. Package registries need fast point queries for metadata. Git gives you a full-document sync protocol when you need a key-value lookup. If you’re building a package manager and git-as-index seems appealing, look at Cargo, Homebrew, CocoaPods, Go. They all had to build workarounds as they grew, causing pain for users and maintainers. The pull request workflow is nice. The version history is nice. You will hit the same walls they did.
nesbitt.io
December 24, 2025 at 4:49 PM
Reposted by Munawwar Firoz
This one got released rather quietly and I think could do with a bit more attention!

Read about how to avoid caching performance penalties due to tracking query params and the like!
December 23, 2025 at 1:57 PM
I keep asking the local shawarma place to introduce annual subscription. They're not sold on the shawarma-as-a-service idea 😛
December 22, 2025 at 3:30 PM
Reposted by Munawwar Firoz
I'm 10 mins into this episode of the #freeCodeCamp podcast. If you're job-hunting, watch/listen to it. Its really insightful so far. @jason.energy is dropping bombs.

#100Devs #webdev
The "AI is going to replace devs" hype is over – 22-year dev veteran Jason Lengstorf [Podcast #201]
YouTube video by freeCodeCamp.org
www.youtube.com
December 19, 2025 at 9:50 PM
Remix 3 component model but with lit-html

I wish I had enough time to build this
December 21, 2025 at 8:43 AM
The Return of the Sinusitis
December 18, 2025 at 12:40 PM
Reposted by Munawwar Firoz
Usable listboxes!!! (Plus styleable as a nice bonus) This includes multi-select in listbox mode.
December 16, 2025 at 10:26 PM
ssr-sandbox alpha v3

- exposed many web apis from deno_web and deno_crypto

- input json is sanitized by default (for prototype pollution)

- default timeout 5 seconds (DoS mitigation)

Still 10ms cold start (now uses v8 snapshot) and 0.1ms on subsequent requests on my machine
December 13, 2025 at 9:08 AM
Theoretically RSC is safe
December 12, 2025 at 5:40 AM
Reposted by Munawwar Firoz
🕵️‍♂️ Stop investigating complex UI libraries.

New web features are on the case so you can build powerful, performant, and interactive app-like experiences easier than ever → goo.gle/3Mwse6n
December 10, 2025 at 5:00 PM
Sandboxed JS runtime based on deno core to run SSR code

This also mean you can use non-JS backend to run this is as a child process

github.com/Munawwar/ssr...
GitHub - Munawwar/ssr-sandbox: Run JS SSR bundles in a sandboxed environment
Run JS SSR bundles in a sandboxed environment. Contribute to Munawwar/ssr-sandbox development by creating an account on GitHub.
github.com
December 9, 2025 at 5:58 AM
I think all the 90s - 2000s Indians have seen Baby's Day Out movie, as it randomly pops up in conversations.

(Movie failed in US but it was hugely successful in India)
December 7, 2025 at 3:54 PM
Reposted by Munawwar Firoz
I grew up in skate-adjacent circles but could never skate for shit, so this joyful look back at Tony Hawk's Pro Skater, 2000s alt culture and countless attempts to do a kickflip hit the nostalgia pretty hard
Tony Hawk's Pro Skater Made Me Delusional
YouTube video by Mikey Lee
youtu.be
December 7, 2025 at 10:10 AM
RSC Remote Sabotage Capability
December 7, 2025 at 11:50 AM
Reposted by Munawwar Firoz
Fit width text in 1 line of CSS
`text-grow: per-line scale;`

nerdy.dev/css-text-grow

(prototype in Canary 165+)
December 5, 2025 at 6:48 AM
Reposted by Munawwar Firoz
Is it news that clever code contains clever bugs?

The bigger question is, did it have to be so clever? Was it worth it?
December 3, 2025 at 5:20 PM
My uncle (60+) too sees dreams where he is setting in an exam hall staring blank at a question paper and panicking 😂
November 23, 2025 at 6:57 PM