all of this looks OK before #374 was introduced.

Timeout was introduced in #360 and update check was skipped entirely in production.

Now it's all back to naive and potentially breaking implementation.

serve@8.2.0