3.1.39

Changed

• Bump verbb/base (Twig sandbox no longer allows Illuminate collection callable gadgets / collect()).

Fixed

• Fix HubSpot form mapping exposing and submitting only the first communication subscription consent checkbox.
• Fix a security vulnerability with how submission redirect URLs and the Twig sandbox were handled.
• Stop signing the raw request URL as returnUrl (path-only, purpose-bound), so attacker-controlled query strings cannot be replayed as a posted redirect template.
• Fix hCaptcha forms inside modals (or otherwise hidden on page load) hanging forever on submit, caused by rendering the widget before the hCaptcha JS API was fully ready. (#2949)
• Fix Date field calendar locale not mapping Craft language codes to Flatpickr (e.g. Norwegian nb → no, Catalan ca → cat, Greek el → gr), and preserve regional locales like zh-TW.
• Fix sessionKey render option causing a 403 on submit when populateFormValues() was called before renderForm(), which could cache an incomplete submission from a different session scope.