Function is_safe_version_component 

pub fn is_safe_version_component(v: &str) -> bool

A pinned version string is used as a path component, so it must be a plain version: letters, digits and ., -, _, +, no .., bounded. Anything else (including empty — an unpinned provider) has no shared dir and falls back to the legacy per-version location.