September 2026 has been an exciting year for w64devkit, the software distribution that is never truly complete. Peter0x44 joined as co-maintainer and pushed the project in new directions, with improvements going back upstream to benefit all users. A major focus this year has been on release security; in April, release packaging became signed, with all EXEs and DLLs now code-signed using the maintainer's key. This established a good reputation, with thousands of unique signatures observed across roughly 100,000 hosts due to the inclusion of ~300 binaries per release. MSYS2 has adopted the signing tool, aas-sign, now included in w64devkit releases. Builds are automated via GitHub Actions, triggered solely when the maintainer pushes a new tag, ensuring full transparency and preventing secret tampering. Furthermore, release immutability has been enabled, locking artifacts upon publish and preventing even the maintainer from modifying old releases.

Regarding toolchain changes, the x64 release is now a "multilib" toolchain, capable of compiling programs for 32-bit Windows, superseding the dedicated x86 release which is now reserved for running w64devkit on older hardware. To target x86, users can pass -m32 or use tools prefixed with the i686-w64-mingw32 architecture triple. Significant updates include the adoption of bigobj COFF format by default in Binutils upstream, resolving previous build limitations for large C++ projects and restoring cgo functionality. Additionally, GCC has been patched so the compiler can be invoked directly from scripts without requiring the bin/ directory on the $PATH.