Version 1.60

Release date: July 21, 2026 Highlights You can now disable bulk data export app-wide with the new client.disableDataExport config option. When set, the CSV export button is hidden for st.dataframe , st.data_editor , and chart table views, and clipboard copy is disabled for read-only dataframes ( #15910 , #8402 , #11358 ). Notable Changes Security hardening ( breaking changes ): Streamlit now rejects host messages that appear to originate from child iframes or injected scripts, preventing origin spoofing (CWE-346) ( #15800 ).