Golden Versions

The Golden Version

Sonatype’s Component Intelligence identifies a component version as the Golden Version when it qualifies for the recommended non-breaking with dependencies remediation strategy and is selected as the best candidate based on compatibility scoring.

In API responses, this corresponds to the remediation type recommended-non-breaking-with-dependencies.
This is a recommended version of the component (including its dependencies) that is selected to eliminate critical and high-severity policy violations, while minimizing the likelihood of breaking changes based on compatibility analysis.

Note
The Golden Version recommendation is currently available for the Maven ecosystem only.

Spotting Golden Versions

If Sonatype Component Intelligence identifies a Golden Version for a component, the Suggested Remediation in the Priorities View is shown as ‘Recommended non-breaking with dependencies version’, indicating the most preferred remediation strategy when available.

Click on the row to view the Golden Version of the component on the component details page

Spotting Golden Versions in IDEs

If Sonatype Component Intelligence finds a Golden Version for a policy violation, it can flag the suggestion in the supported Integrated Development Environment (IDE). The Golden Version can then be easily applied by the developers, seamlessly within the context of the IDE.

Prerequisites to view Golden Versions in the IDE:

• Your IDE has been integrated with one of the available Sonatype IQ Server plugins for IDE.

The IQ Server IDE plugins that are currently support Golden PR are:

1. IntelliJ IDEA
2. Visual Studio Code
3. Eclipse

The Golden PR

Sonatype IQ Server plugins for Source Control Management (SCM) can create PRs (pull request) with comments to upgrade dependencies to the recommended Golden Version. These versions are upgrade suggestions intended to remediate policy violations at or above the configured severity threshold, while minimizing the likelihood of breaking changes.

Using Golden Version recommendations can help improve the success rate of version upgrades.

Prerequisites to view Golden PRs in the SCM system

1. Your SCM environment has been integrated using one of the available Sonatype IQ Server plugins.
2. Check the Sonatype Developer dashboard to see if the application has been configured to use automatic SCM Feedback.
3. Automated Pull Requests is enabled for the SCM.

Viewing Golden PRs in Source Control Management Systems

The source control management platforms that currently support Golden PRs are:

• GitHub
• GitLab
• Bitbucket
• Azure DevOps

Note
Automated remediation pull requests create pull requests only for Golden Versions by default.

How is the Golden Version Different from Recommended Version?

The Golden Version of a component is selected to remediate policy violations at or above the configured severity threshold on the component and its dependencies. The recommendation is intended to minimize the likelihood of breaking changes.

The recommended version of a component (seen as ‘Bumping to version xxx’ in PR comments) remediates policy violations at or above the configured severity threshold on the component itself. It may not remediate policy violations in its dependencies and validates that all transitive dependencies meet security thresholds.

When a Golden Version of a component is not available, the recommended version of the component can be used as an alternative remediation option.

In API responses, this corresponds to the remediation type recommended-non-breaking.