Pinned versions
Nothing here is “latest”. Every binary is pinned to an exact version and locked to a checksum, fetched on demand from its own upstream and prepared for macOS before it runs.
This is the same table the home page shows — one component, one data file, so the marketing claim and this reference cannot drift apart.
PHP
Seven versions. Switch a site between them in one click — no rebuild of docroot, certificate or database.
| PHP | 8.5.8 · 8.4.23 · 8.3.31 · 8.2.31 · 8.1.34Per-site switch, per-version php.ini editor | Xdebug 3.5.3 |
|---|---|---|
| PHP 8.0 | 8.0.30Past its php.net security-end date, and the app badges it as such | EOL · no Xdebug |
| PHP 7.4 | 7.4.33rexenv's own reproducible build — static-php.dev publishes no 7.4 | EOL · no Xdebug |
Web servers
One shared Nginx serves every site by default. Override per site when a project needs something else.
| Nginx | 1.30.3Shared, one server block per site | Default |
|---|---|---|
| FrankenPHP | 1.12.4Per-site override; embeds its own PHP | |
| Apache httpd | 2.4.68Per-site override with working .htaccess | |
| Caddy | 2.11.4The edge — TLS termination on :80 and :443 |
Databases
Chosen per site at create time. Each engine keeps a separate data directory per version series, so switching is never an in-place upgrade.
| MySQL | 8.4.6 · 8.0.44 | :13306 |
|---|---|---|
| MariaDB | 12.3.2 · 11.4.1211.4 is the LTS series | :13307 |
| PostgreSQL | 18.4.0 · 17.10.0 · 16.14.0 | macOS 26+:15432 |
| Redis | 8.8.0 | :16379 |
Tools
Bundled, pinned, and checksum-locked like everything else.
| WP-CLI | 2.12.0Powers the WordPress manager and `rex wp` | |
|---|---|---|
| Composer | 2.10.2Always run through the site's own PHP | |
| Adminer | 5.4.2Deep-linked into the site's database | |
| Mailpit | 1.30.3Catches every outgoing mail | :11025 / 18025 |
| cloudflared | 2026.6.1Quick tunnels, outbound-only | |
| Xdebug | 3.5.3PHP 8.1–8.5 only; your IDE listens on 9003 |
Ports are offset from the usual defaults on purpose, so rexenv never collides with a server you already run.
Why pinned
Section titled “Why pinned”A local environment that silently moves under you is not reproducible, and “it broke and I changed nothing” is usually a version that changed itself. Pinning means:
- The stack you had last month is the stack you have today.
- A version bump is a rexenv release with a changelog, not a background download.
- Every artefact is verified against a recorded SHA before it is allowed to run, so a compromised or truncated download fails loudly rather than executing.
Switching versions
Section titled “Switching versions”PHP is per site and one click, in the app or with rex site php <domain> 8.3.
Databases keep a separate data directory per version series, so moving between them is
never an in-place upgrade — the old series’ data is still there if you switch back.
rex db versions --set <engine> <version> does it from a terminal.