v2.3.0

Added

• #[Sensitive] with the HasSensitiveFields trait: the value is kept out of
  hydration error messages, serialize() throws while it is set, and
  var_dump() / print_r() show [redacted]. toArray() is unchanged.

Security

• Card numbers (13–19 digits) are masked to the last four digits in every
  library exception message and in HydrationResult::errors().
• UuidCast, MoneyCast, DateTimeCast and DateTimeImmutableCast escape
  control characters in their messages.

Changed

• Messages that contain a 13–19 digit number now show it masked.
• Documentation: EncryptedCast page corrected (format, tamper error, key
  requirements, a working key-rotation procedure).
• Releases ship with a source archive, a CycloneDX SBOM and a build
  provenance attestation (gh attestation verify). Security reports go
  through GitHub private vulnerability reporting; 2.x is the supported line.

Upgrade note: error messages that contain a 13–19 digit number now show it masked (************1111). To use #[Sensitive], add use HasSensitiveFields; to the class.