diff --git a/TODO.md b/TODO.md
index 2a167f2..e12b6d4 100644
--- a/TODO.md
+++ b/TODO.md
@@ -29,6 +29,11 @@ P2: security: referer blacklist
 
 # Completed Steps
 
+- 2026-10-04 `.golangci.yml` re-vendored from the canonical copy (closes #57):
+  the deprecated `gomodguard` is switched off, so lint runs print no
+  deprecation warning; its successor `gomodguard_v2` runs with the shared
+  module block list, and `depguard` keeps `net/http/httptest` out of files that
+  are not tests. The tree needed no code changes.
 - 2026-10-04 the image route's signature check and error answers are tested
   (closes #76): new tests in `internal/handlers`, with no network, check the
   status and JSON error body for a missing, wrong, unpadded, upper-case or