Pydantic AI 2.61: Structured Citations, Local Sandboxes and Upgrade Checks

Pydantic AI 2.61.0 is available, adding structured citations to model responses and carrying them through supported provider and frontend integrations. It follows 2.60.0's new local sandbox options for agents that run commands or edit files.

Together, the releases address two practical questions: can an application preserve where an answer came from, and where should an agent's executable work happen? Developers upgrading an existing application should test both rather than treating the release as a model-name refresh.

What Pydantic AI 2.61 adds for citations

The 2.61.0 release notes list citations on TextPart, normalization for Bedrock, OpenRouter and xAI, and preservation through the Vercel AI adapter. GitHub records publication on October 24, although the release title is dated October 23.

A common representation gives application code a clearer place to handle sources. A useful acceptance test is whether a citation remains attached to the intended answer after streaming, saving, reloading and rendering. A source link visible in the first response is only one part of that journey.

History replay has deliberate limits. The merged replay change sends supported Anthropic web-search citations and OpenAI Responses URL or file annotations back to their originating provider when validation permits. Other cases fall back to plain text. Document citations are not replayed because their positional reference can become unreliable after history changes.

That matters for applications that compact conversations or let users edit prior answers. Preserving a citation object does not establish that the edited sentence is still supported by its source. Teams should test those transformations explicitly and avoid promising that every citation survives every provider switch.

Docker and BoxLite have different network defaults

The 2.60.0 release introduced DockerSandbox for Docker or Podman and BoxLiteSandbox for a local micro-VM. These are execution choices for the harness, not new language models. The sandbox capabilities belong to the separate pydantic-ai-harness package.

The defaults deserve attention:

• DockerSandbox starts new containers with network access. Docker's bridge can reach the internet and local services. Setting allow_internet_access=False selects an isolated network configuration. Containers share a kernel, and writable mounts remain a route for changing host files.
• BoxLiteSandbox starts new boxes without network access. Enabling it allows connections reachable from the host; allowed_hosts can narrow that access. Its micro-VM runs locally with a separate kernel, without requiring a cloud account.

Choose the environment around the workload. A dependency-install task needs a different network policy from a job reading a supplied repository. Start with only the project files and destinations the task needs, and verify the effective policy rather than relying on the word "sandbox."

Upgrade checks before production

For teams moving across both versions, 2.60 changes default MCP capability IDs to the server hostname, requiring explicit IDs for multiple servers on one host. It also deprecates RetryPromptPart in favor of newer retry representations.

Version 2.61 accepts asynchronous authentication functions in hosted MCP capabilities and changes how thinking=False is handled for models that cannot disable reasoning.

A focused regression pass should cover saved-history replay, citation rendering, authentication for two different users, workspace reuse and network-denial tests. Compare the resulting requests and permissions, not just whether the agent returns a plausible answer. These checks turn a broad framework upgrade into a reviewable application change.

I'm Paras. I work at the intersection of AI, engineering and distribution.

I help technical founders explain developer-tool releases through practical integration decisions, clear limitations and useful engineering stories.

Book a 30-minute call.