v1.0.3

Changed

• CI: ci.yml gained concurrency cancellation and per-job timeout-minutes;
  the redundant typecheck step was dropped — pnpm run test already compiles
  the project with tsc (declarations included) before running node:test, so
  pnpm run verify was compiling the same project twice.
• CLI numeric flags (--port, --local, --remote-port, --vnc-port) now
  reject a missing, non-numeric or out-of-range value with a usage message and
  exit code 2, instead of reaching listen(NaN) and failing with an opaque
  error. Validation lives in the pure parsePort helper so it is unit-testable
  without spawning a process.

Fixed

• test/upstream.test.mjs: the abort test's mock upstream waited 5 s although
  the abort fires at 100 ms; the wait is now 1.5 s. Same discriminating power,
  ~3.5 s less per CI run.

Added

• .github/dependabot.yml — weekly grouped updates for npm and github-actions.
• test/cli.test.mjs — covers parsePort end to end.