v2.2.1

Security

• #[Rules] now validate values sent under an input alias
  (#[MapInputName], #[MapPropertyName], #[MapOutputName]). Previously
  such values were hydrated unvalidated.
• #[InferRules] validates nested #[Discriminator] fields and collection
  items against the rules of the concrete class.
• MoneyCast rejects amounts outside the int range instead of silently
  saturating, and parses decimal strings in linear time (no ReDoS).
• Control characters in exception messages are escaped (no log forging).

Fixed

• fromResult() / fromValidatedResult() report input that fails to read or
  validate under $input instead of throwing.
• Metadata cache: sdo:warm rebuilds stale files; corrupt files are rebuilt;
  an unwritable directory falls back to memory; object defaults without
  __set_state() are not persisted; clearCache() takes the path literally
  and removes orphaned temp files; temp names are random and files are never
  world-writable.
• EncryptedCast rejects arrays and non-Stringable objects instead of
  encrypting "Array".

Changed

• Documentation: Performance page and XML figures now come from the public
  benchmark; new navigation and theme.

Upgrade note: requests that previously slipped invalid data through an input alias or a nested discriminated object are now rejected with a validation error. Run php artisan sdo:warm after deploying (and reload PHP-FPM if opcache runs with validate_timestamps=0).