Components

Coduva downloads the servers and tools it needs to run into its own component directory (C:\Coduva). The version to download, where to get it, and the expected SHA-256 value are written in the component manifest bundled with the application (resources/components.json).

Versions

Manifest date: 13 November 2026.

Component	Version	Installation	Size	Official source
Nginx	1.30.6	Default	~3 MB	nginx.org
PHP	8.4.27	Default	~35 MB	windows.php.net
PHP	8.3.36	Optional	~34 MB	windows.php.net
PHP	8.5.12	Optional	~36 MB	windows.php.net
MariaDB	11.8.9 LTS	Default	~97 MB	archive.mariadb.org
Composer	2.11.2	Default	~4 MB	getcomposer.org
WP-CLI	2.12.0	Default	~7 MB	github.com/wp-cli
phpMyAdmin	5.2.3	Default	~16 MB	files.phpmyadmin.net
Node.js	26.13.1 LTS	Optional	~41 MB	nodejs.org
CA certificate bundle	2026-11-05	Default	~0.2 MB	curl.se

The Install components button downloads all of the default components (about 155 MB in total). Optional PHP versions and Node.js are installed separately from the PHP and Node screen.

The PHP packages are the Windows "NTS" (non-thread-safe), x64 builds; they work with Nginx over FastCGI. Coduva supports PHP 8.0 and later; if an older version is found, it is marked Not supported.

CA certificate bundle

This package contains the root certificates PHP needs to verify server certificates on outgoing HTTPS requests (cURL, file_get_contents, Composer). Coduva points curl.cainfo and openssl.cafile in the generated php.ini file to this bundle. It has nothing to do with the Coduva local certificate authority used for local HTTPS.

Download and verification

Every component goes through the same steps:

1. Download. The package is downloaded from the official address listed in the manifest to C:\Coduva\downloads\<file>.part. The SHA-256 value is computed during the download.
2. Verification. The computed value is compared with the one in the manifest. If they do not match, the downloaded file is deleted and the installation stops; the interface shows the File could not be verified error.
3. Extraction. Zip packages are first extracted to a temporary .<version>.partial folder. Paths inside the zip that leave the target folder, such as ../, are skipped (zip-slip protection).
4. Move into place. The extracted folder is moved to its final location in one step. An interrupted installation never appears as "installed".

In the interface, each component's status follows these steps: Downloading, Verifying, Extracting, Installed, Installed (already present) or Failed.

Where the SHA-256 values come from

Component	Where the value comes from
PHP	windows.php.net release list (releases.json)
Composer	.sha256sum file on getcomposer.org
WP-CLI	.sha256 file on the GitHub release page
CA bundle	.sha256 file on curl.se
phpMyAdmin	.sha256 file on files.phpmyadmin.net
Node.js	SHASUMS256.txt on nodejs.org
MariaDB	Release information from downloads.mariadb.org (REST API)
Nginx	nginx.org publishes only a PGP signature; the value was computed from the file downloaded from the official HTTPS address

The WordPress core is not a component. When a new WordPress project is created, the latest version is downloaded as a zip from downloads.wordpress.org and verified against the .sha1 value published by WordPress.org. The verified zip is kept in C:\Coduva\downloads; the same version is not downloaded again.

Installation layout

Components are kept side by side by version, so several PHP versions can be installed at the same time.

C:\Coduva\bin\
  nginx\1.30.6\
  php\8.3.36\
  php\8.4.27\
  php\8.5.12\
  mariadb\11.8.9\
  node\26.13.1\
  composer\        composer.phar
  wp-cli\          wp-cli.phar
  shims\           composer.bat, wp.bat (composer and wp commands in the terminal)
C:\Coduva\apps\phpmyadmin\

Coduva finds the installed versions by scanning the C:\Coduva\bin\{nginx,mariadb,php,node}\<version> folders; it does not keep a separate record.

Removing a version

When a version is removed from the PHP and Node screen, its folder is deleted. Removal is refused in these cases:

• The default PHP version cannot be removed; first select another version with Make default.
• A PHP or Node version used by a project cannot be removed.
• A running PHP version cannot be removed; first stop the web server.

Updates

The component list (versions, addresses, SHA-256 values) is built into Coduva and is updated together with the Coduva version; a new Coduva version may bring a new component manifest. A Coduva update does not change installed components on its own.

Coduva itself checks for new versions and installs them with your approval; see Keeping Coduva up to date. For changes, see the Release notes page.