Pinned versions
Nothing here is “latest”. Every binary is pinned to an exact version and locked to a checksum, fetched on demand from its own upstream and prepared for your machine before it runs.
This is the same table the home page shows — one component, one data file, so the marketing claim and this reference cannot drift apart.
A Mac on macOS 13 or 14 gets a different pin on some rows, printed on the row as “On macOS 13: …” — the last upstream build of that component that still loads there, measured on both chips. A row that says “not available” on a macOS is refused by the app with the macOS it needs. Which pin you get is decided from the running macOS at every launch, so upgrading the Mac moves you to the standard row on the next start — on the same data.
The Windows build is the same versions from different publishers — PHP from php.net’s NTS builds, nginx from nginx.org, MySQL from Oracle’s CDN, PostgreSQL from the same portable project — each pinned to a digest rexenv downloaded and hashed itself. Five rows are not in it at all and are badged below rather than dropped: a shorter table would read as an omission, and “rexenv has no Redis on Windows” is the answer to the question.
The Linux build is the same versions again, native for x86_64 and arm64 — PHP 8.x from static-php.dev’s Linux builds (7.4 is rexenv’s own, as on macOS), MySQL from Oracle’s CDN, PostgreSQL from the same portable project, the rest from each project’s own Linux release. Four rows are not in it — Apache, Xdebug, Redis and MariaDB — and are badged the same way. FrankenPHP, missing on Windows, is there.
PHP
Seven versions. Switch a site between them in one click — no rebuild of docroot, certificate or database.
| PHP | 8.5.8 · 8.4.23 · 8.3.32 · 8.2.32 · 8.1.34rexenv's own builds on macOS, with PDO PostgreSQL; php.net's on Windows, static-php.dev's on Linux. Per-site switch, per-version php.ini editor | Xdebug 3.5.3 · macOS |
|---|---|---|
| PHP 8.0 | 8.0.30The one PHP rexenv does not build — static-php.dev's, and past its security-end dateOn macOS 13: not available — the app says which macOS it needs | EOL · no Xdebug · no PostgreSQL |
| PHP 7.4 | 7.4.33rexenv's own reproducible build, on macOS and Linux — static-php.dev publishes no 7.4 | EOL · no Xdebug · no PostgreSQL |
Web servers
One shared Nginx serves every site by default. Override per site when a project needs something else.
| Nginx | 1.30.4Shared, one server block per site. rexenv's own build | Default |
|---|---|---|
| FrankenPHP | 1.12.4Per-site override; embeds its own PHP | Not on Windows |
| Apache httpd | 2.4.68Per-site override with working .htaccessOn macOS 13: 2.4.65 | Not on WindowsNot on Linux |
| OpenLiteSpeed | 1.9.3Per-site override with .htaccess and LSCache. rexenv's own build | Not on Windows |
| Caddy | 2.11.4The edge — TLS termination on :80 and :443 |
Databases
Chosen per site at create time. Each engine keeps a separate data directory per version series, so switching is never an in-place upgrade.
| MySQL | 8.4.6 · 8.0.44On macOS 13: 8.4.3 · 8.0.40 | :13306 |
|---|---|---|
| MariaDB | 12.3.2 · 11.4.1211.4 is the LTS seriesOn macOS 13: 12.0.2 · 11.4.8 | Not on WindowsNot on Linux:13307 |
| PostgreSQL | 18.6.0 · 17.11.0 · 16.15.0A site database for Laravel and blank PHP on PHP 8.1+On macOS 14: 16.4.0On macOS 13: not available — the app says which macOS it needs | Not for WordPress:15432 |
| Redis | 8.8.0On macOS 13: 8.2.1 | Not on WindowsNot on Linux:16379 |
Tools
Bundled, pinned, and checksum-locked like everything else.
| WP-CLI | 2.12.0Powers the WordPress manager and `rex wp` | |
|---|---|---|
| Composer | 2.10.2Always run through the site's own PHP | |
| Adminer | 6.1.1Deep-linked into the site's database | |
| Mailpit | 1.30.3Catches every outgoing mail | :11025 / 18025 |
| cloudflared | 2026.6.1Quick tunnels, outbound-onlyOn macOS 14: 2025.4.0On macOS 13: 2025.4.0 | |
| Xdebug | 3.5.3PHP 8.1–8.5 only; your IDE listens on 9003. On macOS 13, PHP 8.1–8.4 onlyOn macOS 13: 3.4.5 | Not on WindowsNot on Linux |
Ports are offset from the usual defaults on purpose, so rexenv never collides with a server you already run.
Why pinned
Section titled “Why pinned”A local environment that silently moves under you is not reproducible, and “it broke and I changed nothing” is usually a version that changed itself. Pinning means:
- The stack you had last month is the stack you have today.
- A version bump is a rexenv release with a changelog, not a background download.
- Every artefact is verified against a recorded SHA before it is allowed to run, so a compromised or truncated download fails loudly rather than executing.
Two things can move without a release, and only because you pressed a button: a PHP patch within a minor you already have, and Adminer. Both take their checksum from a signed manifest whose public key is compiled into the app, and neither can move you below the version this table states — the pin is the floor. See Patch updates.
Switching versions
Section titled “Switching versions”PHP is per site and one click, in the app or with rex site php <domain> 8.3.
Databases keep a separate data directory per version series, so moving between them is
never an in-place upgrade — the old series’ data is still there if you switch back.
rex db versions --set <engine> <version> does it from a terminal.