Concerns: pushword/newsletter, @pushword/js-helper
If you use pushword/newsletter, two things changed under newsletter_form().
{{ newsletter_form('slug') }} no longer renders the form. It leaves a placeholder that @pushword/js-helper fills from the live host, the way a conversation form is loaded — which is what lets the markup be built per visitor on a page that was generated once. The page must load js-helper, or the placeholder stays empty and no form appears.
The subscribe endpoint now requires a CSRF token, issued by the new /newsletter/form endpoint. The built-in form carries it; you have nothing to do where the form comes from newsletter_form() and the page and base_live_url are same-site.
Turn it off where they are not. The token lives in the session, and SameSite=Lax withholds that cookie when a static build is served from one domain while PHP runs on another. There, every subscription would answer 403:
pushword:
apps:
- hosts: ['example.com']
newsletter_csrf_protection: false
Same call if you post /newsletter/subscribe from your own front end without fetching a form first — either turn it off, or fetch a token and send the session cookie back with the post.
Two smaller changes ride along: several audiences now travel as hidden fields rather than as one checkbox each — one submission subscribes to all of them, so split them into two forms if each is its own consent — and the form no longer carries an inline <script>, which is what broke it when it was loaded into a page dynamically.