diff --git a/cloud-sync.js b/cloud-sync.js
index 7e44932b..e310ddd3 100644
--- a/cloud-sync.js
+++ b/cloud-sync.js
@@ -740,8 +740,15 @@ function openReportModal() {
 // hand-edited files ever matter.
 export function parseMsProjectXml(xml) {
   const tag = (block, name) => {
-    const m = block.match(new RegExp(`<${name}>([^<]*)</${name}>`));
-    return m ? m[1].trim() : '';
+    // 🛡️ Sentinel: Replaced dynamic RegExp with string indexOf to prevent ReDoS via uncontrolled name arguments
+    const startTag = `<${name}>`;
+    const endTag = `</${name}>`;
+    const startIndex = block.indexOf(startTag);
+    if (startIndex === -1) return '';
+    const contentStart = startIndex + startTag.length;
+    const endIndex = block.indexOf(endTag, contentStart);
+    if (endIndex === -1) return '';
+    return block.substring(contentStart, endIndex).trim();
   };
   const unescape = (s) => s
     .replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"')
diff --git a/index.html b/index.html
index a7f4b49c..2a4e6164 100644
--- a/index.html
+++ b/index.html
@@ -5,7 +5,9 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'none'; form-action 'self';" />
     <title>ScopeWeave Planner</title>
-    <link rel="preload" href="styles.css" as="style" />
+    <!-- ⚡ Bolt: Use modulepreload to fetch ES modules early and flatten network waterfall -->
+    <link rel="modulepreload" href="cloud-sync.js" />
+    <link rel="modulepreload" href="analytics.js" />
     <link rel="modulepreload" href="app.js" />
     <link rel="stylesheet" href="styles.css" />
   </head>
diff --git a/package-lock.json b/package-lock.json
index 21575e82..0b8dfbc7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,7 +8,7 @@
       "name": "scopeweave",
       "version": "1.0.0",
       "dependencies": {
-        "@hono/node-server": "^1.19.14",
+        "@hono/node-server": "^2.0.11",
         "hono": "^4.12.27"
       },
       "devDependencies": {
@@ -17,12 +17,12 @@
       }
     },
     "node_modules/@hono/node-server": {
-      "version": "1.19.14",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
-      "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==",
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.11.tgz",
+      "integrity": "sha512-bjD221KPLoJTWUwso1J6fGKiTXEUFedG/s0visavY4zakFPkeGURMRNly+FhBHs7T8Dz4qHaZIMX9ZoJHSJtKA==",
       "license": "MIT",
       "engines": {
-        "node": ">=18.14.1"
+        "node": ">=20"
       },
       "peerDependencies": {
         "hono": "^4"
diff --git a/package.json b/package.json
index 9ae8b292..f44fd951 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
     "fuzz": "node --test tests/fuzz/*.mjs"
   },
   "dependencies": {
-    "@hono/node-server": "^1.19.14",
+    "@hono/node-server": "^2.0.11",
     "hono": "^4.12.27"
   },
   "devDependencies": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index bffabf92..8471f45c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -9,8 +9,8 @@ importers:
   .:
     dependencies:
       '@hono/node-server':
-        specifier: ^1.19.14
-        version: 1.19.14(hono@4.12.28)
+        specifier: ^2.0.11
+        version: 2.0.11(hono@4.12.28)
       hono:
         specifier: ^4.12.27
         version: 4.12.28
@@ -24,9 +24,9 @@ importers:
 
 packages:
 
-  '@hono/node-server@1.19.14':
-    resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==}
-    engines: {node: '>=18.14.1'}
+  '@hono/node-server@2.0.11':
+    resolution: {integrity: sha512-bjD221KPLoJTWUwso1J6fGKiTXEUFedG/s0visavY4zakFPkeGURMRNly+FhBHs7T8Dz4qHaZIMX9ZoJHSJtKA==}
+    engines: {node: '>=20'}
     peerDependencies:
       hono: ^4
 
@@ -63,7 +63,7 @@ packages:
 
 snapshots:
 
-  '@hono/node-server@1.19.14(hono@4.12.28)':
+  '@hono/node-server@2.0.11(hono@4.12.28)':
     dependencies:
       hono: 4.12.28