Several defaults change in this release (Bedrock maxTokens, MCP capability ids, retry part types), so upgrading Pydantic AI agents may alter behavior and needs a compatibility check.
Key takeaways · AI-distilled
Pydantic AI v2.60.0 adds local sandboxes for agent workspaces: a DockerSandbox capability that runs in a Docker or Podman container, and BoxLiteSandbox on a BoxLite micro-VM.
Compatibility notes include deprecating RetryPromptPart in favor of ToolReturnPart(outcome='retried') and RetryFeedbackPart, and defaulting BedrockConverseModel's maxTokens to Claude's maximum output, streamingSending a model's response token by token as it is generated, so the reader sees text immediately instead of waiting for the whole answer.Full definition → such requests behind the scenes.
Several changes tighten injection boundaries: sanitize_messages now strips request-level instructions and client-supplied TextContent.metadata from untrusted history, and framework tags are wrapped so a </system> in an instruction or tool name cannot end its block.
The new RelevanceCompaction keeps, reduces or drops each older history step based on a judge model's ranking, and MCPToolset can take auth and headers as functions of the run context windowThe maximum amount of text a model can consider at once — its working memory for the current conversation or task.Full definition → so each run connects as its own user.
The MCP capability now derives its default id from the server's hostname only and rejects two servers on one host without explicit ids, so such setups must now name each server.
Terms in this piece · Glossary
context compaction — Summarizing an agent's earlier conversation to free room in the context window so a long session can keep going.
agent harness — The scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.
streaming — Sending a model's response token by token as it is generated, so the reader sees text immediately instead of waiting for the whole answer.
context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.
