suggest a po4a version not subject to DoS