Constant ADVERSARIAL_URL_SEGMENTS 

pub const ADVERSARIAL_URL_SEGMENTS: &[&str];

Canonical adversarial identifier values for the recurring dot-segment / unvalidated-URL-sink defect class (#337, #341, #349, #357, #361).

A manifest-declared package name, scope, or coordinate segment spliced into a registry/API URL via format!/string interpolation without validation. A bare ./.. survives naive percent-encoding unchanged (. is an RFC 3986 unreserved character) and is silently removed by a URL parser’s dot-segment normalization once the string is assembled and parsed, letting the request escape the intended host or path prefix; the remaining entries cover a would-be traversal attempt, whitespace, and query/fragment injection.