1.60.0
Breaking Changes📦 streamlitView on GitHub →
⚠ 2 breaking✨ 8 features🐛 30 fixes🔧 15 symbols
Summary
This release introduces several new features including native toolbars for Vega-Lite charts, integer pixel values for the `gap` parameter, and improved handling of `st.data_editor` keys. It also includes numerous bug fixes for stability and security, alongside breaking changes that limit query string sizes and reject spoofed host messages.
⚠️ Breaking Changes
- Limit client-supplied query string size and field count. This may break applications that rely on very large or complex query strings.
- Reject spoofed host messages from child frames and scripts. This change enhances security and may break applications that were inadvertently sending such messages.
Migration Steps
- Update `server.maxWidgetStateSize` configuration if you were previously relying on larger widget state sizes.
- Review applications that send large or complex query strings to ensure they comply with the new size and field count limits.
✨ New Features
- Move vega-lite chart actions to native toolbar.
- Support integer pixel values for `gap` parameter in layout functions.
- Use `key` as the main identity for `st.data_editor` when `num_rows="fixed"`.
- Add `height` parameter to `st.tabs`.
- Disable dataframe data export by default.
- Neutral treatment for zero delta in `st.metric`.
- Preserve `st.dataframe` row selections on sort.
- Bundle the skills meta-skill in the wheel and install it locally, removing the need for GitHub download.
🐛 Bug Fixes
- Reject non-finite float values from URL parameters.
- Sanitize dangerous Graphviz link URLs.
- Virtualize selectbox dropdown option list for performance.
- Keep viewport gutter around dialogs on narrow screens.
- Surface missing httpx error for auth extra.
- Honor `expose_tokens` with `st.App` programmatic secrets.
- Fix React Aria dialog overlay stacking.
- Fix `st.tabs` panels stacking after widget rerun.
- Remove flaky Missing Submit Button warning.
- Escape HTML in pydeck chart tooltip interpolation.
- Dedupe `run_every` auto-rerun timers per fragment.
- Remove redundant keyboard tab stop from file uploader dropzone.
- Avoid PyArrow 25 thread initialization crash.
- Fix `RuntimeError: reentrant call inside _io.BufferedWriter` on Ctrl+C.
- Fix `IndexError` in `simplify_number` for values >= 1 quadrillion.
- Sanitize dangerous `st.link_button` and `st.image` URLs.
- Cap server dependency major versions.
- Stop auto rerun on fragment evict.
- Style selectbox 'No results' empty state.
- Fix overlays inside popover: stacking and dismissal.
- Restore type-to-search in `st.selectbox`.
- Fix `st.metric` area chart fill baseline.
- Prevent file watcher crash on Windows drive paths.
- Ignore skill symlinks in generated gitignore snippet.
- Suppress mobile keyboard for `selectbox` `filter_mode=None`.
- Submit typed `number_input` value on first Enter in form.
- Improve hashing fallback warning messages.
- Include decorators in `st.echo` output.
- Fix inconsistent checkbox margin in horizontal container within column.
- Fix widgets inside popover-in-dialog being unclickable.