chore: Update nixpkgs pin

Part of #54

Commit 3e889463e499537c602e3ea83da6e33f9dc974da

+ create pnpm derivation directly from version 9.15.1

shell.nix

@@ -1,8 +1,12 @@
 let
-  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/eb28b94bd14835836b539bc3854a6abf929876d4.tar.gz";
+  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/3e889463e499537c602e3ea83da6e33f9dc974da.tar.gz";
   pkgs = import nixpkgs { config = {}; overlays = []; };
 in
 
+let
+  pnpm = pkgs.callPackage ./tools/nix/pnpm.nix { nodejs = pkgs.nodejs_20; };
+in
+
 pkgs.mkShell {
   name = "filc-dev-env";
 
@@ -17,7 +21,7 @@ pkgs.mkShell {
     pkgs.rpm
     pkgs.jre_minimal
     pkgs.nodejs_20
-    pkgs.corepack_20
+    pnpm
     pkgs.llvmPackages_18.libllvm
     pkgs.libffi
     pkgs.libxml2

tools/nix/pnpm.nix

@@ -0,0 +1,33 @@
+{ stdenvNoCC
+, fetchurl
+, nodejs
+}:
+
+# From https://github.com/NixOS/nixpkgs/blob/nixos-24.11/pkgs/development/tools/pnpm/generic.nix
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "pnpm";
+  version = "9.15.1";
+
+  src = fetchurl {
+    url = "https://registry.npmjs.org/pnpm/-/pnpm-${finalAttrs.version}.tgz";
+    hash = "sha256-nlNOcK/vBjdPYSa0S9pXYJRxNc4WowrvEBDpZft+Pj4=";
+  };
+  # Remove binary files from src, we don't need them, and this way we make sure
+  # our distribution is free of binaryNativeCode
+  preConfigure = ''
+    rm -r dist/reflink.*node dist/vendor
+  '';
+
+  buildInputs = [ nodejs ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -d $out/{bin,libexec}
+    cp -R . $out/libexec/pnpm
+    ln -s $out/libexec/pnpm/bin/pnpm.cjs $out/bin/pnpm
+    ln -s $out/libexec/pnpm/bin/pnpx.cjs $out/bin/pnpx
+
+    runHook postInstall
+  '';
+})