Streamlit 1.60.0

What's Changed

Breaking Changes 🛠

• [feature] Add server.maxWidgetStateSize config option by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15804
• [fix] Limit client-supplied query string size and field count by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15803
• [fix] Reject spoofed host messages from child frames and scripts by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15800

New Features 🎉

• [feature] Move vega-lite chart actions to native toolbar by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15806
• [feature] Support integer pixel values for gap parameter (#13005) by @sfc-gh-dbyttow in https://github.com/streamlit/streamlit/pull/15850
• [feature] Use key as main identity for st.data_editor if num_rows="fixed" by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15884
• [feature] Add height parameter to st.tabs (#12217) by @sfc-gh-dbyttow in https://github.com/streamlit/streamlit/pull/15847
• [feature] Disable dataframe data export by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15910
• [feature] Neutral treatment for zero delta in st.metric by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15790
• [feature] Preserve st.dataframe row selections on sort by @lukasmasuch in https://github.com/streamlit/streamlit/pull/16020

Bug Fixes 🐛

• [fix] Reject non-finite float values from URL params by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15799
• [fix] Sanitize dangerous Graphviz link URLs by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15819
• [fix] Virtualize selectbox dropdown option list by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15870
• [fix] Keep viewport gutter around dialog on narrow screens by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15875
• [fix] Surface missing httpx error for auth extra by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15864
• [fix] Honor expose_tokens with st.App programmatic secrets by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15865
• [fix] Fix React Aria dialog overlay stacking by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15876
• [fix] st.tabs panels stacking after widget rerun by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15894
• [fix] Remove flaky Missing Submit Button warning by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15889
• [fix] Escape HTML in pydeck chart tooltip interpolation by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15820
• [fix] Dedupe run_every auto-rerun timers per fragment by @sfc-gh-lwilby-1 in https://github.com/streamlit/streamlit/pull/15912
• [fix] Remove redundant keyboard tab stop from file uploader dropzone by @sfc-gh-lwilby-1 in https://github.com/streamlit/streamlit/pull/15928
• [fix] Avoid PyArrow 25 thread initialization crash by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15947
• Fix RuntimeError: reentrant call inside _io.BufferedWriter on Ctrl+C by @chang-pro in https://github.com/streamlit/streamlit/pull/15949
• Fix IndexError in simplify_number for values >= 1 quadrillion by @eeshsaxena in https://github.com/streamlit/streamlit/pull/15971
• [fix] Sanitize dangerous st.link_button and st.image URLs by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15851
• [fix] Cap server dependency major versions by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15948
• [fix] stop auto rerun on fragment evict by @sfc-gh-lwilby-1 in https://github.com/streamlit/streamlit/pull/15932
• [fix] Style selectbox 'No results' empty state by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15967
• [fix] Overlays inside popover: stacking and dismissal by @sfc-gh-lwilby-1 in https://github.com/streamlit/streamlit/pull/15961
• [fix] Restore type-to-search in st.selectbox by @sfc-gh-lwilby-1 in https://github.com/streamlit/streamlit/pull/15996
• [fix] Fix st.metric area chart fill baseline by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15907
• [fix] Prevent file watcher crash on Windows drive paths by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15951
• [fix] Ignore skill symlinks in generated gitignore snippet by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15963
• [fix] Suppress mobile keyboard for selectbox filter_mode=None by @lukasmasuch in https://github.com/streamlit/streamlit/pull/15962
• [fix] Submit typed number_input value on first Enter in form by @lukasmasuch in https://github.com/streamlit/streamlit/pull/16013
• [fix] Improve hashing fallback warning messages by @lukasmasuch in https://github.com/streamlit/streamlit/pull/16040
• [fix] Bundle the skills meta-skill in the wheel; install it locally (no GitHub download) by @sfc-gh-nbellante in https://github.com/streamlit/streamlit/pull/16026
• [bugfix] Include decorators in st.echo output by @sfc-gh-dbyttow in https://github.com/streamlit/streamlit/pull/16068
• [bugfix] Fix inconsistent checkbox margin in horizontal container within column (#13162) by @sfc-gh-dbyttow in https://github.com/streamlit/streamlit/pull/16060
• [bugfix] Fix widgets inside popover-in-dialog being unclickable by @sfc-gh-dbyttow in https://github.com/streamlit/streamlit/pull/16067

Other Changes

• [chore] Update emojis/material icons by @github-actions[bot] in https://github.com/streamlit/streamlit/pull/15860
• [chore] Update emojis/material icons by @github-actions[bot] in https://github.com/streamlit/streamlit/pull/15983
• [chore] Replace cachetools with internal TTLCache by @lukasmasuch in https://github.com/streamlit/streamlit/pull/16014

New Contributors

• @chang-pro made their first contribution in https://github.com/streamlit/streamlit/pull/15949
• @eeshsaxena made their first contribution in https://github.com/streamlit/streamlit/pull/15971
• @kobihikri made their first contribution in https://github.com/streamlit/streamlit/pull/16016

Full Changelog: https://github.com/streamlit/streamlit/compare/1.59.2...1.60.0