diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index df66a09..42fd8d6 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -10,7 +10,7 @@ jobs:
   build:
     strategy:
       matrix:
-        go-version: [1.23.x, 1.24.x, 1.25.x]
+        go-version: [oldstable, stable]
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
diff --git a/.golangci.yml b/.golangci.yml
index 8695057..8c02cb6 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,31 +1,29 @@
-version: 2
+version: "2"
 
 linters:
-  disable-all: true
+  default: none
   enable:
-    # --- The Critical Checks (Gap Fixers) ---
-    - errcheck # Catches your file.Close errors
-    - gosec # Catches your G304 security issue
-    - revive # Catches your missing comment issues
-    - govet # Standard Go vetting
+    - errcheck
+    - gosec
+    - revive
+    - govet
+  settings:
+    revive:
+      rules:
+        - name: exported
+          arguments:
+            - disableStutteringCheck
+  exclusions:
+    paths:
+      - third_party
+      - builtin
+      - examples
 
 formatters:
   enable:
     - gofmt
     - goimports
-
-linters-settings:
-  revive:
-    rules:
-      - name: exported
-        arguments:
-          - disableStutteringCheck
-
-  goimports:
-    local-prefixes: github.com/mikemadden42
-
-issues:
-  exclude-dirs:
-    - third_party
-    - builtin
-    - examples
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/mikemadden42
diff --git a/TODO.md b/TODO.md
new file mode 100644
index 0000000..84b01e5
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1,51 @@
+# TODO
+
+## Bugs / correctness
+
+- [x] Fix `.golangci.yml`. It fails `golangci-lint config verify` (v2), so the
+      linter selection is ignored (staticcheck runs despite "disable-all"):
+  - [x] `version: 2` should be `version: "2"`
+  - [x] `linters.disable-all` should be `linters.default: none`
+  - [x] `linters-settings` should be `linters.settings`
+  - [x] goimports settings go under `formatters.settings.goimports.local-prefixes` (list)
+  - [x] `issues.exclude-dirs` should be `linters.exclusions.paths`
+- [ ] Fix `.goreleaser.yaml`. It fails `goreleaser check`:
+  - [ ] Add `version: 2`
+  - [ ] `snapshot.name_template` should be `snapshot.version_template`
+  - [ ] Remove the no-op `go generate ./...` hook
+- [x] HTTP handling in `github_status.go`:
+  - [x] Use an `http.Client` with a timeout instead of `http.Get`
+  - [x] Close `response.Body`
+  - [x] Check `response.StatusCode` before decoding
+- [x] Replace `panic` with an error message on stderr and `os.Exit(1)` (or `log.Fatal`)
+
+## Code quality
+
+- [ ] Trim the `summary` struct to the fields actually used; `interface{}` should be `any`
+- [ ] Print the overall status (`Status.Description`)
+- [ ] Replace the if/else chain with a `switch` (staticcheck QF1003) covering
+      `operational`, `degraded_performance`, `partial_outage`, `major_outage`,
+      `under_maintenance`
+- [ ] Filter the "Visit www.githubstatus.com for more information" filler row
+- [x] Use `json.NewDecoder(resp.Body).Decode` instead of `io.ReadAll` + `Unmarshal`
+- [ ] Use the readable URL `https://www.githubstatus.com/api/v2/summary.json`
+- [x] Add a package comment (revive)
+- [ ] Exit non-zero when any component isn't operational
+
+## Tests / CI
+
+- [ ] Split into `fetch(url)` and `render(w io.Writer, summary)`; test `render`
+      with a JSON fixture and `fetch` with `httptest.NewServer`
+- [ ] Add a lint job (`golangci/golangci-lint-action`) to CI
+- [x] CI targets Go `oldstable` and `stable` (via `actions/setup-go` aliases)
+- [x] Raise `go.mod` to `go 1.26` to match the oldest Go version CI tests
+- [ ] Bump `actions/setup-go` / `actions/checkout`
+- [ ] Update dependencies (`go get -u ./... && go mod tidy`); `x/sys` v0.25.0 → v0.50.0,
+      `fatih/color` v1.18.0 → v1.19.0
+
+## Housekeeping
+
+- [ ] Delete the Jenkinsfile unless Jenkins is in use (build-only, no tests, echo-only post blocks)
+- [ ] `make release` uses `--snapshot`, so it never publishes. Rename the target or drop the flag
+- [ ] Add `dist/` and `github_status` to `.gitignore`
+- [ ] Expand the README with usage, install and example output
diff --git a/github_status.go b/github_status.go
index bf57f95..e941b76 100644
--- a/github_status.go
+++ b/github_status.go
@@ -1,3 +1,4 @@
+// Command github_status prints the status of each GitHub component.
 package main
 
 // https://tutorialedge.net/golang/consuming-restful-api-with-go/
@@ -6,8 +7,9 @@ package main
 import (
 	"encoding/json"
 	"fmt"
-	"io"
 	"net/http"
+	"os"
+	"time"
 
 	"github.com/fatih/color"
 )
@@ -43,14 +45,17 @@ type summary struct {
 }
 
 func main() {
-	response, err := http.Get("https://kctbh9vrtdwd.statuspage.io/api/v2/summary.json")
+	client := &http.Client{Timeout: 10 * time.Second}
+	response, err := client.Get("https://kctbh9vrtdwd.statuspage.io/api/v2/summary.json")
 	checkErr(err)
+	defer func() { _ = response.Body.Close() }()
 
-	responseData, err := io.ReadAll(response.Body)
-	checkErr(err)
+	if response.StatusCode != http.StatusOK {
+		checkErr(fmt.Errorf("unexpected HTTP status: %s", response.Status))
+	}
 
 	var responseObject summary
-	err = json.Unmarshal(responseData, &responseObject)
+	err = json.NewDecoder(response.Body).Decode(&responseObject)
 	checkErr(err)
 
 	for _, component := range responseObject.Components {
@@ -70,6 +75,7 @@ func main() {
 
 func checkErr(err error) {
 	if err != nil {
-		panic(err)
+		fmt.Fprintln(os.Stderr, "error:", err)
+		os.Exit(1)
 	}
 }
diff --git a/go.mod b/go.mod
index ec040de..ba00820 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/mikemadden42/github_status
 
-go 1.18
+go 1.26
 
 require github.com/fatih/color v1.18.0