v1.60.1

What's Changed

• fix(agent-server): bump Debian snapshot for apt CVE-2026-109518 by @VascoSch92 in #6501
• fix(agent-server): fetch apt packages over HTTPS and pin the Debian base by @VascoSch92 in #6502
• test: fold near-identical tests into pytest.mark.parametrize by @VascoSch92 in #6505
• fix(tools): name the patch action that references a missing file by @yftx293 in #6371
• fix(sdk): slice diffed costs by position so a timestamp tie keeps them by @yftx293 in #6484
• ci(release): open release and version-bump PRs as openhands-release-bot by @neubig in #6516
• fix(sdk): accept underscore-prefixed MCP argument names by @yftx293 in #6381
• fix(plugin): percent-encode secret values in plugin source URL user info by @ak684 in #6511
• fix(workspace): stop the container when Docker/Apptainer startup fails by @VascoSch92 in #6499
• Release v1.60.1 by @openhands-release-bot[bot] in #6522

New Contributors

• @openhands-release-bot[bot] made their first contribution in #6522

Full Changelog: v1.60.0...v1.60.1