add nixpkgs-22.11 to flake inputs

flake.nix

@@ -26,6 +26,10 @@
     # Pin to a specific nixpkgs version that has compatible v8 and curl versions
     # for extensions that require older package versions
     nixpkgs-oldstable.url = "github:NixOS/nixpkgs/a76c4553d7e741e17f289224eda135423de0491d";
+    nixpkgs-oldstable.flake = false;
+    # Older clang and glibc for building extensions on old pgrx versions (before 0.11.3)
+    nixpkgs-2211.url = "https://channels.nixos.org/nixos-22.11/nixexprs.tar.xz";
+    nixpkgs-2211.flake = false;
     nixpkgs.url = "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz";
     rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
     rust-overlay.url = "github:oxalica/rust-overlay";

nix/cargo-pgrx/mkPgrxExtension.nix

@@ -1,11 +1,12 @@
 {
-  callPackage,
+  lib,
   pkgs,
+  callPackage,
+  clang11,
   rustVersion,
   pgrxVersion,
   makeRustPlatform,
   rust-bin,
-  stdenv,
 }:
 let
   inherit ((callPackage ./default.nix { inherit rustVersion rust-bin; })) mkCargoPgrx;
@@ -38,20 +39,15 @@ let
     };
 
   bindgenHook =
-    # Fix bindgen error on aarch64-linux for versions using pgrx with bindgen 0.68.1
-    # This affects pgrx 0.6.1 through 0.11.2 which have issues with ARM NEON vector ABI
-    if (builtins.compareVersions "0.11.3" pgrxVersion > 0) then
-      let
-        nixos2211 = (
-          import (builtins.fetchTarball {
-            url = "https://channels.nixos.org/nixos-22.11/nixexprs.tar.xz";
-            sha256 = "1j7h75a9hwkkm97jicky5rhvzkdwxsv5v46473rl6agvq2sj97y1";
-          }) { inherit (stdenv.hostPlatform) system; }
-        );
-      in
+    # pgrx 0.6.1 through 0.11.2 use old bindgen versions that break with current clang and glibc:
+    # - bindgen 0.60.x panics on how clang 16+ names anonymous structs
+    #   ("(unnamed at /path/file.h:N:M)"), which glibc and macOS SDK headers contain.
+    # - on aarch64-linux, bindgen fails on the ARM NEON vector functions that newer glibc headers declare.
+    # So build them with clang and glibc headers from nixos-22.11, on every platform.
+    if lib.versionOlder pgrxVersion "0.11.3" then
       rustPlatform.bindgenHook.overrideAttrs {
-        libclang = nixos2211.clang.cc.lib;
-        clang = nixos2211.clang;
+        libclang = clang11.cc.lib;
+        clang = clang11;
       }
     else
       rustPlatform.bindgenHook;

nix/nixpkgs.nix

@@ -6,7 +6,6 @@
       _module.args.pkgs = import inputs.nixpkgs {
         inherit system;
         config.allowUnfree = true;
-        permittedInsecurePackages = [ "v8-9.7.106.18" ];
         overlays = [
           # Patch tzdata to 2026f until nixpkgs catches up.
           # Drop once the pinned nixpkgs ships >= 2026f (the assertion below trips):
@@ -97,13 +96,12 @@
           (
             let
               # Provide older versions of packages required by some extensions
-              oldstable = import inputs.nixpkgs-oldstable {
-                inherit system;
-                config.allowUnfree = true;
-              };
+              oldstable = import inputs.nixpkgs-oldstable { inherit system; };
+              nixos2211 = import inputs.nixpkgs-2211 { inherit system; };
             in
             _final: _prev: {
               v8_oldstable = oldstable.v8;
+              clang11 = nixos2211.clang;
             }
           )
         ];