chore(flake): bump nixpkgs so the dev shell tracks the current pnpm

[hakula139]

Summary

• Bump the nixpkgs input so the dev shell provides pnpm 11.21.0 instead of 11.6.0.

Why

CI takes pnpm from the dev shell (nix develop -c pnpm install --frozen-lockfile and the lint / spellcheck steps after it), so the flake is where CI's pnpm version actually comes from. Every other place that installs pnpm across these repos now tracks the current release, and this dev shell was the outlier, pinned through a nixpkgs from 2026-06-23.

Blast radius

Bumping a whole nixpkgs input is wider than a pnpm bump in principle, so here is what actually moves between the old and new revs:

Package	667d5cf (2026-06-23)	c69ae8f (2026-08-18)
pnpm	11.6.0	11.21.0
rustc	1.95.0	1.95.0
clippy	1.95.0	1.95.0
nodejs_24	24.16.0	24.19.0

The Rust toolchain does not move, which is the part that could have broken cargo clippy --all-targets -- -D warnings through new lints. So in practice this is a pnpm bump plus a Node patch bump.

nix flake update nixpkgs was used rather than a bare nix flake update, so no other input changes. The diff is three lines of flake.lock.

Verification

Inside nix develop on the bumped lock:

pnpm:  11.21.0
real:  /nix/store/...-pnpm-11.21.0/libexec/pnpm/bin/pnpm.mjs
rustc: rustc 1.95.0 (59807616e 2026-04-14)

The reported version matching the store path is worth stating, because it shows nothing is re-execing into a different pnpm. readlink -f is the only way to tell a real binary from a shim, since pnpm --version cannot.

The pnpm steps from ci.yml were then run through the dev shell:

• pnpm install --frozen-lockfile: rc=0, Done in 1s using pnpm v11.21.0. Lockfile byte-identical afterwards (cmp rc=0), so no dependency drift.
• pnpm lint: rc=0.
• pnpm spellcheck: rc=0.
• cargo fmt --all --check: rc=0.
• nix flake check --no-build: rc=0, all checks passed!.

Not verified locally: cargo clippy --all-targets -- -D warnings, cargo test, and cargo llvm-cov, which are slow to build here. The table above is the reason for expecting them unaffected, since rustc and clippy are identical across the two revs, but CI on this PR is what actually establishes it.

Note on 11.21.0 rather than 11.22.0

nixpkgs trails the npm latest dist-tag by a day or two, so a Nix-sourced pnpm is always slightly behind. That is inherent to pinning the toolchain in a flake, and it is the trade the dev shell makes in exchange for being reproducible and offline-capable.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!