Streamlit 1.60.0 adds security fixes, vega-lite toolbar, and tab heights
Patch for spoofed host messages and new UI controls for data apps
Streamlit 1.60.0, released July 21, focuses on security hardening and user experience improvements. Key security fixes include rejecting spoofed host messages from child frames and scripts, sanitizing dangerous Graphviz and URL links (st.link_button, st.image), limiting client-supplied query string size and field count, and capping server dependency major versions. These changes address potential injection and spoofing attack vectors, making Streamlit apps more secure by default.
On the feature side, Streamlit 1.60.0 moves vega-lite chart actions to a native toolbar, simplifying interaction with visualizations. Tabs (st.tabs) now support a height parameter, enabling better layout control. The data editor (st.data_editor) uses its key as the primary identity when num_rows is set to "fixed", improving state management. Additionally, st.metric treats zero delta neutrally, integer pixel values are allowed for the gap parameter, and dataframe row selections persist across sorts. Bug fixes address selectbox dropdown virtualization, dialog overlays, and widget stacking issues.
- Security: Rejects spoofed host messages, sanitizes dangerous URLs in link_button, image, and Graphviz
- New UI: Vega-lite chart actions move to native toolbar; st.tabs gets height parameter
- Data improvements: st.data_editor uses key as identity for fixed rows; st.metric neutral for zero delta
Why It Matters
Streamlit 1.60.0 enhances security and UI flexibility, critical for professional data applications.