golangci/golangci-lint · error

'%s' is invalid, use low instead. Valid options: low, medium

Error message

'%s' is invalid, use low instead. Valid options: low, medium, high

What it means

gosec's severity/confidence threshold in golangci-lint is converted from a string ('low'/'medium'/'high') to gosec's numeric score. convertToScore falls back to the default case, returning issue.Low together with this error, so an unrecognized threshold string fails the linter run.

Source

Thrown at pkg/golinters/gosec/gosec.go:239

	if len(excludes) > 0 {
		filters = append(filters, rules.NewRuleFilter(true, excludes...))
	}

	return filters
}

// code borrowed from https://github.com/securego/gosec/blob/69213955dacfd560562e780f723486ef1ca6d486/cmd/gosec/main.go#L250-L262
func convertToScore(str string) (issue.Score, error) {
	str = strings.ToLower(str)
	switch str {
	case "", "low":
		return issue.Low, nil
	case "medium":
		return issue.Medium, nil
	case "high":
		return issue.High, nil
	default:
		return issue.Low, fmt.Errorf("'%s' is invalid, use low instead. Valid options: low, medium, high", str)
	}
}

// code borrowed from https://github.com/securego/gosec/blob/69213955dacfd560562e780f723486ef1ca6d486/cmd/gosec/main.go#L264-L276
func filterIssues(issues []*issue.Issue, severity, confidence issue.Score) []*issue.Issue {
	res := make([]*issue.Issue, 0)

	for _, i := range issues {
		if i.Severity >= severity && i.Confidence >= confidence {
			res = append(res, i)
		}
	}

	return res
}

View on GitHub (pinned to ed7a235d2d)

Solutions

1. Change the value to one of the lowercase strings: 'low', 'medium', or 'high'
2. Check casing — 'High' or 'HIGH' are invalid; use 'high'
3. Remove numeric values; gosec-standalone numeric scores are not accepted here

Example fix

// before (.golangci.yml)
settings:
  gosec:
    severity: HIGH
// after
settings:
  gosec:
    severity: high

const VALID = ['low','medium','high']
const { severity, confidence } = cfg.settings.gosec ?? {}
for (const [k, v] of Object.entries({ severity, confidence })) {
  if (v !== undefined && !VALID.includes(v)) throw new Error(`gosec ${k} must be low|medium|high, got '${v}'`)
}

const isGosecThreshold = (v) => ['low','medium','high'].includes(v)

When it happens

Trigger: settings.gosec.severity or settings.gosec.confidence is set to a string that isn't exactly 'low', 'medium', or 'high' (case-sensitive); runGoSec calls convertToScore which hits the default branch.

Common situations: Typo like 'Low' or 'MEDIUM', or a numeric threshold (e.g. severity: 3) carried over from running gosec directly instead of the string enum golangci-lint expects.

Related errors

• can't combine option --config and --no-config
• can't get enabled formatters: %w
• failed to set analyzer setting %q with value %q: %w
• settings key %q must be valid analyzer name, valid analyzers
• failed to configure analyzer %s: %w

AI-assisted analysis of golangci/golangci-lint@ed7a235d2d (2026-09-02). Data as JSON: /api/errors/f792678d70b1b70a. Report an issue: GitHub.