chore(deps): update dependency mcp-remote to v0.8.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mcp-remote	0.1.38 → 0.8.3

---

Release Notes

punkpeye/mcp-remote (mcp-remote)

v0.8.3

Compare Source

Bug Fixes

• spend a rotating refresh token once per host, not once per instance (b0b6e22)

v0.8.2

Compare Source

Bug Fixes

• don't lose authorization due to short network flake (#​348) (da68511)

v0.8.1

Compare Source

Bug Fixes

• recover from a token the server refuses and answer requests a dropped session owes (77bbcfc)

v0.8.0

Compare Source

Features

• sign in without a browser using the OAuth device grant (0496a12)

v0.7.0

Compare Source

Bug Fixes

• pick token_endpoint_auth_method from what the authorization server supports (98d646d)
• re-establish the MCP session when the SSE stream reconnects (34299a0)

Features

• identify this client by a metadata document URL with --client-metadata-url (311c7d7)
• keep session cookies so a load-balanced server stays sticky (d5e33f8)
• present the OIDC ID token as the bearer credential with --use-id-token (30df0c8)

v0.6.0

Compare Source

Features

• send extra authorization parameters with --authorize-param (#​345) (6827d32)

v0.5.0

Compare Source

Features

• keep an idle connection alive with --keep-alive (#​343) (34570f3)

v0.4.1

Compare Source

Bug Fixes

• preserve MCP method metadata in HTTP transport (#​309) (b449fac)

v0.4.0

Compare Source

Bug Fixes

• recover stale dynamic OAuth client registrations (#​305) (eec5c2e)
• sign in again when the scopes this client asks for change (#​341) (b4bd25f)

Features

• read custom headers from a file with --header-file (#​342) (5db4f70)

v0.3.3

Compare Source

Bug Fixes

• complete a sign-in the server asks for mid-session (#​340) (df59c77)

v0.3.2

Compare Source

Bug Fixes

• stop discarding stored sign-ins on every release (#​339) (aa994d7)
• stop exchanging tokens in a loop when the server rejects every one (#​338) (21c3f2a)

v0.3.1

Compare Source

Bug Fixes

• authorize with the scopes an insufficient_scope challenge asked for (#​337) (b7c6e40)

v0.3.0

Compare Source

Features

• make network timeouts and IPv4-only connections configurable (#​336) (4763567)

v0.2.7

Compare Source

Bug Fixes

• keep the headers the SDK set on the SSE request (#​335) (8e7b1d7)

v0.2.6

Compare Source

Bug Fixes

• stop mcp-remote-client replacing the dispatcher that settles its own requests (#​334) (ea72471)

v0.2.5

Compare Source

Bug Fixes

• point repository metadata at punkpeye/mcp-remote (a2ab330)

v0.2.4

Compare Source

Bug Fixes

• treat an unrefreshable expired token as needing a sign-in (#​330) (aa3596a)

v0.2.3

Compare Source

Bug Fixes

• only coordinate a sign-in when the server actually asks for one (#​328) (11422f2)

v0.2.2

Compare Source

Bug Fixes

• share one auth flow between 401s that arrive in the same tick (#​326) (f0c07bf)

v0.2.1

Compare Source

Bug Fixes

• stop a secondary instance hanging after another instance completes the sign-in (#​323) (05c3f9c)

v0.2.0

Compare Source

Features

• support customization of the OAuth callback path (#​295) (6d4f8ee)

v0.1.49

Compare Source

Bug Fixes

• write config files atomically so concurrent instances cannot read a torn file (aa0ea84)

v0.1.48

Compare Source

Bug Fixes

• probe a priority-ordered list of OAuth metadata URLs (2d323e6)

v0.1.47

Compare Source

Bug Fixes

• use the IPv4 loopback literal as the default callback host on Windows (2219a78)

v0.1.46

Compare Source

Bug Fixes

• refresh OAuth tokens proactively using a persisted absolute expiry (cf5d76e)

v0.1.45

Compare Source

Bug Fixes

• re-initialize the session when the remote server expires it (cd61dc6)

v0.1.44

Compare Source

Bug Fixes

• propagate MCP-Protocol-Version on post-initialize requests in proxy mode (e84f0c3)

v0.1.43

Compare Source

Bug Fixes

• keep the OAuth resource indicator consistent and allow disabling it (#​218) (d26e5a8)

v0.1.42

Compare Source

Bug Fixes

• discard cached OAuth client registrations that no longer match the callback URL (#​292) (404a0f4)

v0.1.41

Compare Source

Bug Fixes

• log custom header names only, never their values (dbbac4d)

v0.1.40

Compare Source

Bug Fixes

• report the published version in --version and the client name (bdc9e13)

v0.1.39

Compare Source

Bug Fixes

• add Accept-Encoding: identity to OAuth discovery fetch requests (#​279) (2899e55), closes #​276
• don't answer client responses with JSON-RPC errors when forwarding fails (ce213f7)
• don't re-register OAuth client when secondary instance reuses another's auth (ea812fa)
• honor empty scopes_supported in protected resource metadata (f9b98b3)
• oauth: omit scope when scopes_supported is [] (#​240) (79725ac)
• recover from EADDRINUSE on OAuth callback port instead of crashing (#​262) (38f2e8b)
• surface failed request forwards as JSON-RPC errors to the client (#​308) (c5741d8), closes #​106
• test: stop pinning third-party tool lists in e2e assertions (f4915a1)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

[ERROR] This project is configured to use 11.13.0 of pnpm. Your current pnpm is v11.25.0
If you want to bypass this version check, you can set the "pmOnFail" configuration to "warn" or "ignore" (e.g. via --pm-on-fail=ignore). If using "devEngines.packageManager", you can set its "onFail" to "warn" or "ignore"