DoS vulnerability with uPickle for Scala 3

[plokhotnyuk]

See com-lihaoyi/upickle#416

[yakivy]

@plokhotnyuk upickle dependency is compile time only so it's a user responsibility to pick the lib version. I don't think that there is something to fix on my end. Feel free to reopen the issue if you have something to add.

[plokhotnyuk]

The root of the problem is in default implementations of Scala's Map and Set scala/bug#11203 .

But due to shifting responsibility a lot of Scala libraries are affected.

I think that at least it should be clearly stated in docs that the affected library is vulnerable for the untrusted input and the responsibility is shifted to the user.