ci(release): re-lock every Python package after the version bump

[devin-ai-integration]

Summary

Release commits have been leaving packages/code-interpreter-python/uv.lock (and sometimes desktop-python/uv.lock) pinned to the previous e2b version, which then breaks pnpm run format / lint on every PR based on main until someone re-syncs the lock (#1853 (comment)).

Cause: pnpm run -r postVersion runs the three Python packages' uv version concurrently, and uv version re-locks as a side effect. code-interpreter-python and desktop-python declare ../python-sdk as a uv workspace member, so whether their lock picked up the new e2b version depended on whether python-sdk's pyproject.toml had already been bumped when their uv version happened to run — a race. In 2b65658 desktop-python won and code-interpreter-python lost.

Fix: split bumping from locking so locking always runs after every pyproject.toml is at its final version.

 # root package.json
-"version": "pnpm changeset version && pnpm run -r postVersion"
+"version": "pnpm changeset version && pnpm run -r postVersion && pnpm run -r lock"

 # packages/{python-sdk,code-interpreter-python,desktop-python}/package.json
-"postVersion": "uv version $(pnpm pkg get version --workspaces=false | tr -d \\\")"
+"postVersion": "uv version --frozen $(pnpm pkg get version --workspaces=false | tr -d \\\")"
+"lock": "uv lock"

--frozen only edits pyproject.toml (no lock, no venv sync); uv lock then re-resolves each package's lockfile (without --upgrade, so only the workspace e2b entry moves). The Commit new versions step in publish_packages.yml already git add -As, so the updated lockfiles land in the release commit.

Verified locally by bumping python-sdk to 2.49.1 and running pnpm run -r postVersion && pnpm run -r lock: all three uv.lock files end up with e2b at 2.49.1. (An earlier commit added release.test.cjs cases for the ordering; those were dropped when merging main, since #1856 removed the release tooling tests.)

Also includes the one-line code-interpreter-python/uv.lock sync (e2b 2.48.0 → 2.49.0, generated with uv 0.10.0 to match CI) that the 2b65658 release missed, so uv sync --locked passes on this branch; same change as in #1853, so whichever lands first the other merges cleanly.

Internal release scripts only — no changeset.

Link to Devin session: https://app.devin.ai/sessions/939bb24d137e4bdc9fd4c9671d976ada
Open in Devin Desktop: https://app.devin.ai/desktop/session/939bb24d137e4bdc9fd4c9671d976ada?variant=devin
Requested by: @mishushakov

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: 404df12

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

TASTE.md review: this PR only changes release scripts (version/postVersion/lock in root and Python package package.json files) and touches no public SDK surface. Checked the API-shape (T-3–T-25), streaming (T-26–T-30), lifecycle (T-31–T-36), configuration (T-49–T-53), package structure (T-54–T-56) and error (T-57–T-58) rules — none apply to these changes. 0 violations.

[github-actions]

Package Artifacts

Built from 5d6abd0. Download artifacts from this workflow run.

JS SDK (e2b@2.49.1-devin-1788958893-release-uv-lock-sync.0):

npm install ./e2b-2.49.1-devin-1788958893-release-uv-lock-sync.0.tgz

CLI (@e2b/cli@2.19.1-devin-1788958893-release-uv-lock-sync.0):

npm install ./e2b-cli-2.19.1-devin-1788958893-release-uv-lock-sync.0.tgz

Code Interpreter JS SDK (@e2b/code-interpreter@2.8.1-devin-1788958893-release-uv-lock-sync.0):

npm install ./e2b-code-interpreter-2.8.1-devin-1788958893-release-uv-lock-sync.0.tgz

Desktop JS SDK (@e2b/desktop@2.4.1-devin-1788958893-release-uv-lock-sync.0):

npm install ./e2b-desktop-2.4.1-devin-1788958893-release-uv-lock-sync.0.tgz

Python SDK (e2b==2.49.0+devin.1788958893.release.uv.lock.sync):

pip install ./e2b-2.49.0+devin.1788958893.release.uv.lock.sync-py3-none-any.whl

Code Interpreter Python SDK (e2b-code-interpreter==2.10.0+devin.1788958893.release.uv.lock.sync):

pip install ./e2b_code_interpreter-2.10.0+devin.1788958893.release.uv.lock.sync-py3-none-any.whl

Desktop Python SDK (e2b-desktop==2.5.0+devin.1788958893.release.uv.lock.sync):

pip install ./e2b_desktop-2.5.0+devin.1788958893.release.uv.lock.sync-py3-none-any.whl

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c1af51d8f2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[claude]

Looks good — straightforward release-tooling fix. Reviewed the root version script now running pnpm run -r lock after postVersion, the three Python packages' postVersion switching to uv version --frozen plus a new lock script, and confirmed the code-interpreter-python/uv.lock diff only bumps the local e2b dependency version (2.48.0 → 2.49.0), matching the described fix for the version/lock race.

Extended reasoning...

Overview

This PR touches only release/versioning tooling: the root package.json's version script, the postVersion/new lock scripts in packages/code-interpreter-python, packages/desktop-python, and packages/python-sdk, and a regenerated packages/code-interpreter-python/uv.lock. No application code, API surface, or runtime behavior is affected.

Security risks

None identified. The change only affects local build/release scripts invoked during the pnpm changeset version release flow (using uv version --frozen and uv lock), and a lockfile that pins a workspace-local dependency version. No secrets, network calls, or user-facing code paths are touched.

Level of scrutiny

Low. This is a mechanical, well-scoped fix for a documented race condition (concurrent uv version invocations across uv workspace members racing on lock regeneration), matches the PR description's diff exactly, and the lockfile change is a single-line version bump consistent with the stated cause. No CLAUDE.md conventions are violated — it's an internal script/lockfile change that correctly doesn't include a changeset per the repo's stated policy (changesets are only required for public surface changes to cli/js-sdk/python-sdk, and this only changes internal release scripts).

Other factors

The PR conversation timeline shows no unresolved third-party objections — only bot comments (devin-ai-integration, changeset-bot, github-actions) with no CHANGES_REQUESTED review. The fix is self-verifying in principle (splitting bump-then-lock into two sequential phases eliminates the race), and the diff is small enough that no test coverage is needed beyond what the description states was manually verified.