Function is_safe_package_name 

pub fn is_safe_package_name(name: &str) -> bool

Whether name is safe to embed as a package name in a manifest [TextEdit] or completion item.

Guards every arm of create_package_completion_item (crates/deps-lsp/src/handlers/completion.rs) as a single upfront check, applied before the raw name reaches any ecosystem-specific snippet — including Maven and Swift, which additionally validate a derived value on top of this gate (is_safe_maven_coordinate_segment on each split coordinate segment, is_safe_registry_url on the constructed URL) because a value type distinct from the raw name needs its own allowlist — see is_safe_version_string’s doc comment for why version-derived and non-version-derived sinks each get their own allowlist. PackageName::new is documented as never validating or modifying its input, so this predicate is the first gate a registry-reported name passes through before reaching a manifest. Two sinks that key a bare TOML/YAML entry by name (Cargo/PyPI, Dart) additionally quote that key in the snippet, since . and @ are legal here but would otherwise be read as TOML’s dotted-key separator or break a YAML plain scalar.

An allowlist, not a denylist: name must be non-empty, at most 256 bytes, and contain only [A-Za-z0-9._@:/~-] — the character set real package names use across every ecosystem this predicate guards: Cargo/PyPI/Dart/NuGet/Bundler (alphanumeric, -, _, .), npm/Deno scoped names (@scope/name, adding @ and /), Composer (vendor/package, /), Go module paths (domain-qualified paths like github.com/org/repo, /, ., and ~ — legal in a Go path element and already allowed by is_safe_version_string/is_safe_registry_url), and Gradle’s colon-delimited group:artifact short form (:). A denylist here would need to anticipate every dangerous token a target manifest format (TOML/JSON/YAML/XML string literals, a live Kotlin/Groovy build-script DSL) could ever act on; failing closed on an unrecognized character — notably ", ', <, >, `, and all control characters/newlines — is cheaper and safer.

Examples

use deps_core::is_safe_package_name;

assert!(is_safe_package_name("serde"));
assert!(is_safe_package_name("@scope/name"));
assert!(is_safe_package_name("org.apache.commons:commons-lang3"));
assert!(!is_safe_package_name("evil\"\nbackdoor = \"9.9.9"));