Function is_safe_version_string 

pub fn is_safe_version_string(version: &str) -> bool

Whether version is safe to embed in a manifest [TextEdit] or completion item.

Guards every call into formatter::PackageRendering::format_version_replacing/formatter::PackageRendering::format_version_for_text_edit and every completion item’s insert_text/text_edit.

Must be applied to the raw version string before formatting, never to a formatter’s output: some formatters legitimately produce structural characters in their output from an already-validated version plus fixed, trusted operators (e.g. PyPI’s >=1.2.3,<2), so validating the output would wrongly reject those.

An allowlist, not a denylist: version must be non-empty, at most 64 bytes, and contain only [A-Za-z0-9.+_~:*^!-] — the character set real version strings use across every ecosystem this workspace supports (SemVer, PEP 440 including epochs like 1!2.0, Maven qualifiers, npm’s ^/~/* range tokens, Go’s +incompatible suffix). A denylist here would need to anticipate every dangerous token a target manifest format (or a build tool evaluating it, e.g. Gradle’s Kotlin/Groovy DSL interpolating ${...} inside a version literal) could ever act on; failing closed on an unrecognized character is cheaper and safer.

This is the single validation chokepoint shared by every producer of a version-derived TextEdit/completion item in this workspace, including OSV advisory data (an Advisory.fixed_versions entry is exactly as untrusted as a registry-reported version).

Examples

use deps_core::is_safe_version_string;

assert!(is_safe_version_string("1.2.3-alpha.1+build"));
assert!(!is_safe_version_string("1.2.3\", git = \"https://evil"));