RUSTSEC-2026-0187 calls 0.42.0 patched after adding a nesting-depth limit. The limit covers arrays and dictionaries; a stream whose /Length is another stream recurses without it and still aborts.
Slots waited on work. Allowed 12 workers at once, the typical build kept about 1.3 busy (1.31 over 47 builds). In the six biggest, new work came 8 to 12 times too slowly to fill them.
Fewer turns, same score. In three paired runs of one task, a lead agent that only plans took 9 turns instead of 17 and compacted 4 times, not 5. All 168 tests passed. Total tokens did not fall.