Upgrading streamlit 0.89 to 1
Breaking0.89.0 → 1.66.1Breaking28Security7Platform4Deprecated7New310Changed71Fixed368Other172
Fetching 135 releases from GitHub…26 / 135
BreakingUpgrade verdict
28 breaking changes and 4 platform requirement changes and 7 security fixes.
In plain terms
- The old caching function st.cache is gone; use the newer caching decorators instead.
- st.pyplot no longer renders the current global matplotlib figure; you must pass a figure explicitly.
- Code that still passes the old width option to images will stop working.
- The metrics endpoint now collects memory statistics in a cheaper way by default.
Must act Top 5 of 46 that need code or config changes
Python requirement changed in 1.66.0: >=3.6 → >=3.11.
Adds anyio <5,>=4.0.0, itsdangerous <3,>=2.1.2, python-multipart <1,>=0.0.10, starlette <2,>=0.46.0, typing-extensions <5,>=4.10.0, uvicorn <1,>=0.30.0, websockets <18,>=12.0.0.
Drops astor, attrs, base58, blinker, cachetools, gitpython, python-dateutil, toml, tornado, tzlocal, validators.
Installs 34 packages in all (was 38).
Also installs h11.
No longer installs gitdb, smmap.
Moves click 7.1.2 → 8.5.0, watchdog 7.0.0 → 6.0.0. Your build may pick other versions.
What you must change
Breaking28
Removes the deprecated st.cache API.
st.cacheRemoves global-figure support in st.pyplot.
st.pyplotRemoves the deprecated
use_column_width parameter from st.image.st.imageuse_column_widthMakes /_stcore/metrics memory stats cheap by default.
/_stcore/metricsRemoves the deprecated Snowpark connection.
SnowparkRemoves the deprecated st.bokeh_chart command.
st.bokeh_chartRemoves the deprecated
add_rows feature.add_rowsRemoves the LangChain callback handler integration.
Makes Starlette the default server and removes Tornado.
Removes deprecated kwargs from plotly_chart and vega_lite_chart.
plotly_chartvega_lite_chartRemoves the deprecated _get_websocket_headers function.
_get_websocket_headersRemoves the deprecated
st.experimental_user command.st.experimental_userRenames some external CCv2 types.
Removes native bokeh charts support.
Removes **kwargs support from st.write.
st.writeAdds server.maxWidgetStateSize config option to limit widget state size.
server.maxWidgetStateSizeLimits client-supplied query string size and field count.
Rejects spoofed host messages from child frames and scripts.
Converts polars directly to arrow, bypassing pandas.
Removes experimental query params.
Shows the
add_rows deprecation warning in the browser.add_rowsMoves the isolate_styles parameter in CCv2.
isolate_stylesDeprecates kwargs in st.plotly_chart and adds a config dict instead.
st.plotly_chartUses key as the main identity for st.checkbox and st.toggle.
st.checkboxst.toggleUses key as the main identity for st.number_input.
st.number_inputUses key as the main identity for st.text_area and st.text_input.
st.text_areast.text_inputAllows editing of ListColumn via st.data_editor.
ListColumnst.data_editorCleans up experimental dialog, fragment and widget replay APIs.
Security7
Rejects unsafe navigation network paths.
Rejects network paths and null bytes in st.Page to prevent unsafe path handling.
st.PageSanitize dangerous st.link_button and st.image URLs.
st.link_buttonst.imageBlocks javascript: and vbscript: URLs in markdown links.
Prevents SSRF attacks via path traversal in component file handling.
Streamlit is a data oriented application development framework for python. Streamlit Open Source versions prior to 1.54.0 running on Windows hosts have an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. The vulnerability arises from improper validation of attacker-supplied filesystem paths. In certain code paths, including within the
Medium · CVSS 4.8ComponentRequestHandler, filesystem paths are resolved using os.path.realpath() or Path.resolve() before sufficient validation occurs. On Windows systems, supplying a malicious UNC path (e.g., \\attacker-controlled-host\share) can cause the Streamlit server to initiate outbound SMB connections over port 445. When Windows attempts to authenticate to the remote SMB server, NTLMv2 challenge-response credentials of the Windows user running the Streamlit process may be transmitted. This behavior may allow an attacker to perform NTLM relay attacks against other internal services and/or identify internally reachable SMB hosts via timing analysis. The vulnerability has been fixed in Streamlit Open Source version 1.54.0.A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Medium · CVSS 4.7Platform4
Drops Python 3.10 support.
Adds support for Python 3.15.
Adds support for Python 3.14.
Removes Python 3.9 support.
Deprecations to plan for
Deprecated7
Deprecates savefig kwargs on st.pyplot.
st.pyplotDeprecates string file paths in
st.html and st.iframe in favor of pathlib.Path.st.htmlst.iframepathlib.PathAdds a deprecation warning to SnowparkConnection.
SnowparkConnectionAdds a deprecation note to the add_rows command.
add_rowsDeprecates kwargs support for st.vega_lite_chart.
st.vega_lite_chartDeprecates st.bokeh_chart in favour of the streamlit-bokeh component.
st.bokeh_chartstreamlit-bokehLogs a deprecation warning for use_container_width in st.dataframe.
st.dataframeuse_container_width