1.0.21

New

• Added an optional captcha on the admin login form, using a built-in challenge that needs no keys and no third-party service #4254
• Cloudflare Turnstile and Google reCAPTCHA can be used for that challenge instead, on sites that already have them configured in the Form plugin
• The captcha can also guard the forgotten-password and first-run setup forms
• Blueprint fields now carry their sources list to the admin, so a media field can say which pickers it offers

Bugfix

• Fixed the admin never receiving Grav's own translations or any plugin's. Only the admin plugin's strings were being sent, so a plugin's labels showed up as a guess at the key name rather than the text it ships #259
• Fixed every API-key request failing on a site where user/data is not writable by the web server. Recording when a key was last used is bookkeeping and no longer takes down the request that triggered it. Thanks to @sandymac for the report and the diagnosis #30
• Fixed the same failure in three other places: an unwritable folder no longer breaks token validation, frontend page views, or the media manager's thumbnails.
• Errors from a folder that cannot be written now say which path is at fault, instead of reporting a missing temporary file.
• Fixed the account, user group and configuration forms failing with "Parent blueprint missing" on any site that adds its own fields to them. A site's own blueprint was loaded on its own, so the one it was extending was no longer there to extend. Thanks to @nerdyjan for the report and the diagnosis #31