Version 1.60

Official Announcements
1

Release date: July 21, 2026

Highlights

  • :sparkles: You can now disable bulk data export app-wide with the new client.disableDataExport config option. When set, the CSV export button is hidden for st.dataframe, st.data_editor, and chart table views, and clipboard copy is disabled for read-only dataframes (#15910, #8402, #11358).

Notable Changes

  • :locked: Security hardening (breaking changes):
    • Streamlit now rejects host messages that appear to originate from child iframes or injected scripts, preventing origin spoofing (CWE-346) (#15800).
    • Client-supplied query strings are now capped at 512 KiB and 1,000 fields, guarding against unbounded resource allocation (CWE-770) (#15803).
    • New server.maxWidgetStateSize config option (default 25 MB) limits the widget state payload a client can send per script rerun, hardening against oversized widget and custom-component payloads (#15804).
  • :bar_chart: st.dataframe now preserves row selections when the user sorts the table (#16020, #8851).
  • :control_knobs: st.tabs has a new height parameter to set a fixed pixel height for the tab panel area (#15847, #12217).
  • :triangular_ruler: The gap parameter in st.columns now accepts integer pixel values in addition to the existing string presets (#15850, #13005).
  • :artist_palette: st.data_editor now uses key as the primary row identity when num_rows="fixed", improving stability when the underlying data changes (#15884).
  • :chart_increasing: Zero delta values in st.metric are now displayed in neutral grey instead of green or red, so a zero change no longer implies a positive or negative direction (#15790, #15005).
  • :paintbrush: Vega-Lite chart action buttons (download, copy spec to clipboard) are now integrated into the native Streamlit toolbar; the Vega-Lite action menu overlay has been removed (#15806).

Other Changes

  • :bug: Bug fix: Non-finite float values (e.g. NaN, Inf) in URL query params are now rejected to prevent unexpected behavior (#15799).
  • :butterfly: Bug fix: Dangerous URLs in Graphviz link attributes are now sanitized (#15819).
  • :beetle: Bug fix: HTML in PyDeck chart tooltip interpolations is now escaped to prevent injection (#15820).
  • :ant: Bug fix: Dangerous URLs in st.link_button and st.image are now sanitized (#15851).
  • :honeybee: Bug fix: st.selectbox now virtualizes long dropdown option lists for better rendering performance (#15870, #15863).
  • :lady_beetle: Bug fix: Viewport gutter is now preserved around dialogs on narrow screens (#15875).
  • :spider: Bug fix: React Aria dialog overlays now stack correctly when multiple dialogs are open (#15876, #15859).
  • :cockroach: Bug fix: The “Missing Submit Button” warning has been removed (#15889, #14247).
  • :fly: Bug fix: st.tabs panels no longer stack visually after a widget rerun (#15894, #15893).
  • :microbe: Bug fix: st.metric area chart fill baseline is now drawn correctly (#15907).
  • :mosquito: Bug fix: run_every auto-rerun timers are now deduplicated per fragment, preventing duplicate reruns (#15912).
  • :scorpion: Bug fix: Redundant keyboard tab stop removed from the file uploader dropzone for better accessibility (#15928).
  • :cricket: Bug fix: Auto-rerun correctly stops when a fragment is evicted (#15932).
  • :spider_web: Bug fix: A PyArrow 25 thread initialization crash is now avoided (#15947).
  • :snail: Bug fix: Missing httpx error message for the auth extra is now surfaced correctly (#15864).
  • :lizard: Bug fix: st.App with programmatic secrets now correctly honors the expose_tokens setting (#15865).
  • :crab: Bug fix: RuntimeError: reentrant call inside _io.BufferedWriter on Ctrl+C is fixed (#15949, #15740). Thanks, chang-pro!
  • :alien: Bug fix: File watcher no longer crashes on Windows drive-root paths (#15951, #12731).
  • :ghost: Bug fix: Overlay stacking and dismissal inside popovers works correctly (#15961).
  • :bug: Bug fix: Mobile keyboard no longer appears for st.selectbox when filter_mode=None (#15962).
  • :butterfly: Bug fix: st.selectbox “No results” empty state is now styled correctly (#15967).
  • :beetle: Bug fix: IndexError in number formatting for values ≥ 1 quadrillion is fixed (#15971). Thanks, eeshsaxena!
  • :ant: Bug fix: Type-to-search in st.selectbox is restored (#15996, #15985).
  • :honeybee: Bug fix: Typing a value in st.number_input inside a form now correctly submits on the first Enter press (#16013, #13751).
  • :lady_beetle: Bug fix: Hashing fallback warning messages are now more informative (#16040, #10957).
  • :spider: Bug fix: Inconsistent checkbox margin in a horizontal container within a column is fixed (#16060, #13162).
  • :cockroach: Bug fix: Widgets inside a popover that is itself inside a dialog are now clickable (#16067, #16005).
  • :fly: Bug fix: st.echo output now correctly includes decorators on the displayed function (#16068, #9252).
  • :nut_and_bolt: Internal TTLCache implementation replaces the cachetools third-party dependency (#16014).