{"record":{"id":"f792678d70b1b70a","repo":"golangci/golangci-lint","slug":"s-is-invalid-use-low-instead-valid-options-l","errorCode":null,"errorMessage":"'%s' is invalid, use low instead. Valid options: low, medium, high","messagePattern":"'(.+?)' is invalid, use low instead\\. Valid options: low, medium, high","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/golinters/gosec/gosec.go","lineNumber":239,"sourceCode":"\tif len(excludes) > 0 {\n\t\tfilters = append(filters, rules.NewRuleFilter(true, excludes...))\n\t}\n\n\treturn filters\n}\n\n// code borrowed from https://github.com/securego/gosec/blob/69213955dacfd560562e780f723486ef1ca6d486/cmd/gosec/main.go#L250-L262\nfunc convertToScore(str string) (issue.Score, error) {\n\tstr = strings.ToLower(str)\n\tswitch str {\n\tcase \"\", \"low\":\n\t\treturn issue.Low, nil\n\tcase \"medium\":\n\t\treturn issue.Medium, nil\n\tcase \"high\":\n\t\treturn issue.High, nil\n\tdefault:\n\t\treturn issue.Low, fmt.Errorf(\"'%s' is invalid, use low instead. Valid options: low, medium, high\", str)\n\t}\n}\n\n// code borrowed from https://github.com/securego/gosec/blob/69213955dacfd560562e780f723486ef1ca6d486/cmd/gosec/main.go#L264-L276\nfunc filterIssues(issues []*issue.Issue, severity, confidence issue.Score) []*issue.Issue {\n\tres := make([]*issue.Issue, 0)\n\n\tfor _, i := range issues {\n\t\tif i.Severity >= severity && i.Confidence >= confidence {\n\t\t\tres = append(res, i)\n\t\t}\n\t}\n\n\treturn res\n}\n","sourceCodeStart":221,"sourceCodeEnd":255,"githubUrl":"https://github.com/golangci/golangci-lint/blob/ed7a235d2d771152056fdc142a9855567c5796a9/pkg/golinters/gosec/gosec.go#L221-L255","documentation":"gosec's severity/confidence threshold in golangci-lint is converted from a string ('low'/'medium'/'high') to gosec's numeric score. convertToScore falls back to the default case, returning issue.Low together with this error, so an unrecognized threshold string fails the linter run.","triggerScenarios":"settings.gosec.severity or settings.gosec.confidence is set to a string that isn't exactly 'low', 'medium', or 'high' (case-sensitive); runGoSec calls convertToScore which hits the default branch.","commonSituations":"Typo like 'Low' or 'MEDIUM', or a numeric threshold (e.g. severity: 3) carried over from running gosec directly instead of the string enum golangci-lint expects.","solutions":["Change the value to one of the lowercase strings: 'low', 'medium', or 'high'","Check casing — 'High' or 'HIGH' are invalid; use 'high'","Remove numeric values; gosec-standalone numeric scores are not accepted here"],"exampleFix":"// before (.golangci.yml)\nsettings:\n  gosec:\n    severity: HIGH\n// after\nsettings:\n  gosec:\n    severity: high","handlingStrategy":"validation","validationCode":"const VALID = ['low','medium','high']\nconst { severity, confidence } = cfg.settings.gosec ?? {}\nfor (const [k, v] of Object.entries({ severity, confidence })) {\n  if (v !== undefined && !VALID.includes(v)) throw new Error(`gosec ${k} must be low|medium|high, got '${v}'`)\n}","typeGuard":"const isGosecThreshold = (v) => ['low','medium','high'].includes(v)","tryCatchPattern":null,"preventionTips":["Always use lowercase enum strings for gosec severity/confidence in golangci-lint","Don't copy numeric gosec CLI thresholds into golangci-lint config","Add a JSON/YAML schema check on .golangci.yml in CI"],"tags":["golangci-lint","gosec","configuration"],"backgroundTag":"invalid-enum-config-value","analyzedSha":"ed7a235d2d771152056fdc142a9855567c5796a9","analyzedAt":"2026-09-02T18:47:33.865Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}