visave 0.3.3 preview: download resource limits

This preview fixes the three resource-exhaustion paths in the supplied security report. Update both the Firefox extension and the Windows companion.

Fixed

• Invalid native-message framing ends the connection after one error. Page URLs and native request sizes are bounded before transmission.
• Extractor metadata is limited to 16 MiB before decoding. A Windows Job Object limits committed memory to 1 GiB per process and 2 GiB for the downloader process tree. Downloader output is also bounded.
• Collection results are rejected before entries are processed. Each request permits one selected video; audio/video merging and MP3 conversion still work.

Update

Load the 0.3.3 extension ZIP temporarily, open visave Settings > Installation > Install dependencies, open visave-setup-0.3.3.exe, and select Install. An older companion is reported incomplete; downloads stay disabled until the current protections are detected. Choose your save folder once in Settings.

Checks

57 native tests and 33 JavaScript tests passed, including a real compressed metadata response, repeated videos inside a template, oversized frame bodies, and worker/child memory limits. Firefox checks, isolated installation lifecycle checks, and packaged MP4/MP3 downloads passed; the MP4 fixture retained 60 FPS. A public Blender YouTube metadata simulation also succeeded without cookies or media downloads. These checks cover specific paths, not every site.

See security-fix details. This fixes the reviewed mechanisms; it is not an independent audit or a statement that scanner findings have been closed.

Windows x64 only. The installer and Firefox preview remain unsigned. Mozilla signing and AMO approval are pending. Firefox requires users to open the installer themselves; no security protections are bypassed.