pypa/pipx 1.18.9 on GitHub

Extend the 1.18.8 handling of recorded pip arguments to uv's path options and to --group. pipx no longer records --group, which names a pyproject.toml to read packages from, like -r. On POSIX, a recorded --config-file, --project, --directory, --overrides/--override or --excludes/--exclude that points at a path another account could change stops pipx upgrade, pipx reinstall and the other replaying commands with the same error as --find-links. pipx list --outdated runs the same check and reports such an environment as failed instead of querying the recorded location. pipx runpip reads its install arguments with the same parser, so it records an install written as -qe ./project or -e./project as editable (#2363) by @gaborbernat.
When a rebuild fails during a parallel pipx reinstall-all, the restored environment gets back the shared app, man page or completion links another environment took while the rebuild had it in the trash, unless something outside this run has replaced them since (#2371) by @gaborbernat.
pipx run no longer reuses a cached environment after a change to a variable outside PIP_* and UV_* that decides which config file pip or uv reads, which proxy or index answers, which certificate is trusted or which credentials are sent, such as XDG_CONFIG_HOME, SSL_CERT_FILE, HTTPS_PROXY or NETRC. The values only feed the cache key's hash, so secrets in them stay out of cache paths and logs (#2364) by @gaborbernat.