v1: release 1.0.3 with the pending fixes #2753

Summary

Bump v1/main from 1.0.2 to 1.0.3 to release the pending fixes on the v1-latest dist-tag.

v1 receives security fixes only. The changes this release ships are tracked privately until they are published, so they are not listed here. The release notes will list them once they are.

Scope

Version fields only, no functional change. Same shape as 1.0.2 (#2080):

• version in package.json, client/, server/, cli/
• the three @modelcontextprotocol/inspector-* workspace dependency ranges in the root package.json (^1.0.2 -> ^1.0.3)
• the matching version fields in package-lock.json, edited directly rather than through npm run update-version's trailing npm install, to avoid re-resolving the tree (see v1: release 1.0.2 with the pending security and audit fixes #2080)

Ordering

Merge this after the pending fixes have landed on v1/main, so 1.0.3 contains them.

Release checklist

• Pending fixes merged to v1/main
• This bump merged
• node scripts/check-version-consistency.js passes and npm ci accepts the lockfile unchanged on the merged v1/main
• Publish a GitHub release with the bare tag 1.0.3 (matching 1.0.0–1.0.2; the v1 release tags ruleset protects refs/tags/1.*), targeting v1/main, with "Set as the latest release" unchecked so v2 keeps Latest: gh release create 1.0.3 --target v1/main --title 1.0.3 --latest=false. The release event runs the publish job in .github/workflows/main.yml, which runs npm run publish-all to the v1-latest dist-tag with provenance (see fix: v1 dist-tag must be v1-latest — npm rejects v1 #1829) and also pushes the container image to ghcr.io