publish a new release without `pubspec.lock`