Adds Pyodide version check to prevent incorrect bundle release

src/pyodide/internal/python.ts

@@ -29,6 +29,7 @@ import { default as SetupEmscripten } from 'internal:setup-emscripten';
 import { default as UnsafeEval } from 'internal:unsafe-eval';
 import { simpleRunPython } from 'pyodide-internal:util';
 import { loadPackages } from 'pyodide-internal:loadPackage';
+import { default as MetadataReader } from 'pyodide-internal:runtime-generated/metadata';
 
 /**
  * After running `instantiateEmscriptenModule` but before calling into any C
@@ -79,6 +80,28 @@ function maybeAddVendorDirectoryToPath(pyodide: Pyodide) {
   `);
 }
 
+/**
+ * Verifies that the Pyodide version in our compat flag matches our actual version. This is to
+ * prevent us accidentally releasing a Pyodide bundle built against a different version than one
+ * we expect.
+ */
+function validatePyodideVersion(Module: Module) {
+  const expectedPyodideVersion = MetadataReader.getPyodideVersion();
+  if (expectedPyodideVersion == 'dev') {
+    return;
+  }
+  try {
+    simpleRunPython(
+      Module,
+      `from pyodide import __version__ as v; assert v == \'${expectedPyodideVersion}\'; del v`
+    );
+  } catch {
+    throw new Error(
+      `Pyodide version mismatch, expected '${expectedPyodideVersion}'`
+    );
+  }
+}
+
 export async function loadPyodide(
   isWorkerd: boolean,
   lockfile: PackageLock,
@@ -118,6 +141,8 @@ export async function loadPyodide(
 
   finishSnapshotSetup(pyodide);
 
+  validatePyodideVersion(Module);
+
   // Need to set these here so that the logs go to the right context. If we don't they will go
   // to SetupEmscripten's context and end up being KJ_LOG'd, which we do not want.
   Module.API.initializeStreams(

src/workerd/io/compatibility-date.capnp

@@ -721,7 +721,7 @@ struct CompatibilityFlags @0x8f8c1b68151b6cef {
       $impliedByAfterDate(name = "nodeJsCompat", date = "2025-04-01");
   # Automatically populate process.env from text bindings only
   # when nodejs_compat is being used.
-  
+
   cacheApiRequestCfOverridesCacheRules @77 :Bool
       $compatEnableFlag("cache_api_request_cf_overrides_cache_rules")
       $experimental