[xiaoyao-666-coder]

isPort('+80'), isPort('+65535'), and isPort('-0') currently return true: isInt allows a leading sign, and these values satisfy the numeric range check. Port strings should contain decimal digits without a sign; see RFC 3986 section 3.2.3.

Reject a leading + or - in isPort, retaining the existing range, leading-zero, and string-type checks. Add regression cases for signed zero and positive ports.

Validation on Windows with Node.js 24.22.1:

• The new regression test fails on unchanged master (isPort("+0") passed but should have failed) and passes after the fix.
• npm test: build and ESLint pass; 324 tests pass.
• Generated Node entry point, individual module, browser bundle, and minified bundle: 76 checks pass, including valid boundaries and non-string input errors.

AI assistance: OpenAI Codex assisted with the code change, regression tests, validation, and this PR description.

Checklist

• PR contains only changes related; no stray files, etc.
• README updated (where applicable): no API or option changes to document.
• Tests written (where applicable)
• References provided in PR (where applicable)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (9ff3424) to head (bb9fef0).

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2957   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2599      2599           
  Branches       658       659    +1     
=========================================
  Hits          2599      2599           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.