fix(serialization): apply exclude recursively for keys nested inside Pydantic models

[lntutor]

What's broken

to_serializable(obj, exclude={...}) applies exclude recursively for dicts (filtered at every level), lists, and dataclasses (both forward exclude into recursive calls). The BaseModel branch is the exception: it passes exclude to model_dump() — which only drops top-level fields (a set exclude is not recursive in Pydantic v2) — and then recurses into the resulting dict without forwarding exclude:

class Address(BaseModel):
    street: str
    secret: str
class Person(BaseModel):
    name: str
    address: Address

to_serializable(Person(name="John", address=Address(street="123 Main St", secret="TOP-SECRET")), exclude={"secret"})
# {'name': 'John', 'address': {'street': '123 Main St', 'secret': 'TOP-SECRET'}}  <- 'secret' leaked

Since to_serializable serializes agent/task/event state (e.g. to_string), this leaks fields a caller explicitly asked to drop — potentially sensitive data.

Fix

Forward exclude into the BaseModel branch's recursive calls (both the model_dump path and the __dict__ fallback), relying on the existing recursive dict-branch filtering. Top-level exclusion is unchanged.

Tests

Extends lib/crewai/tests/utilities/test_serialization.py: a nested-model exclude case, and a parity check that the model path matches the plain-dict path. Full file passes (27). Distinct from #2479 (which added the exclude option).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 49c0eca7-e486-4c3b-9630-25745dd4d655

📥 Commits

Reviewing files that changed from the base of the PR and between 69c0308 and 420994a.

📒 Files selected for processing (2)

• lib/crewai/src/crewai/utilities/serialization.py
• lib/crewai/tests/utilities/test_serialization.py

---

📝 Walkthrough

Walkthrough

to_serializable now propagates exclude through nested Pydantic serialization, including its fallback path. Tests verify recursive field exclusion and matching output for nested Pydantic models and equivalent dictionaries.

Changes

Serialization exclusions

Layer / File(s)	Summary
Recursive exclusion handling lib/crewai/src/crewai/utilities/serialization.py, lib/crewai/tests/utilities/test_serialization.py	Nested model serialization and fallback field serialization now forward exclude; tests cover recursive exclusion and parity with plain dictionary input.

Suggested reviewers: vinibrsl

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main fix: recursive exclude handling for nested Pydantic model fields.
Description check	✅ Passed	The description matches the changeset and explains the bug, fix, and tests for recursive exclude handling.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}