⚡ Bolt: 네트워크 워터폴을 줄이기 위해 modulepreload 적용 및 중복 preload 제거

cloud-sync.js

@@ -740,8 +740,15 @@ function openReportModal() {
 // hand-edited files ever matter.
 export function parseMsProjectXml(xml) {
   const tag = (block, name) => {
-    const m = block.match(new RegExp(`<${name}>([^<]*)</${name}>`));
-    return m ? m[1].trim() : '';
+    // 🛡️ Sentinel: Replaced dynamic RegExp with string indexOf to prevent ReDoS via uncontrolled name arguments
+    const startTag = `<${name}>`;
+    const endTag = `</${name}>`;
+    const startIndex = block.indexOf(startTag);
+    if (startIndex === -1) return '';
+    const contentStart = startIndex + startTag.length;
+    const endIndex = block.indexOf(endTag, contentStart);
+    if (endIndex === -1) return '';
+    return block.substring(contentStart, endIndex).trim();
   };
   const unescape = (s) => s
     .replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"')

index.html

@@ -5,7 +5,9 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'none'; form-action 'self';" />
     <title>ScopeWeave Planner</title>
-    <link rel="preload" href="styles.css" as="style" />
+    <!-- ⚡ Bolt: Use modulepreload to fetch ES modules early and flatten network waterfall -->
+    <link rel="modulepreload" href="cloud-sync.js" />
+    <link rel="modulepreload" href="analytics.js" />
     <link rel="modulepreload" href="app.js" />
     <link rel="stylesheet" href="styles.css" />
   </head>

package.json

@@ -17,7 +17,7 @@
     "fuzz": "node --test tests/fuzz/*.mjs"
   },
   "dependencies": {
-    "@hono/node-server": "^1.19.14",
+    "@hono/node-server": "^2.0.11",
     "hono": "^4.12.27"
   },
   "devDependencies": {