# Golden Versions

## The Golden Version

Sonatype’s Component Intelligence identifies a component version as the _Golden Version_ when it qualifies for the recommended non-breaking with dependencies remediation strategy and is selected as the best candidate based on compatibility scoring.

In API responses, this corresponds to the remediation type _recommended-non-breaking-with-dependencies_.  
This is a recommended version of the component (including its dependencies) that is selected to eliminate critical and high-severity policy violations, while minimizing the likelihood of breaking changes based on compatibility analysis.

**Note**  
The Golden Version recommendation is currently available for the Maven ecosystem only.

### Spotting Golden Versions

If Sonatype Component Intelligence identifies a _Golden Version_ for a component, the _Suggested Remediation_ in the Priorities View is shown as ‘_Recommended non-breaking with dependencies version_’, indicating the most preferred remediation strategy when available.

Click on the row to view the _Golden Version_ of the component on the [component details page](https://help.sonatype.com/en/component-details-page.html "Component Details Page")

#### Spotting Golden Versions in IDEs

If Sonatype Component Intelligence finds a Golden Version for a policy violation, it can flag the suggestion in the supported Integrated Development Environment (IDE). The Golden Version can then be easily applied by the developers, seamlessly within the context of the IDE.

**Prerequisites to view Golden Versions in the IDE**:

- Your IDE has been integrated with one of the available Sonatype IQ Server plugins for IDE.

The IQ Server IDE plugins that are currently support Golden PR are:

1. [IntelliJ IDEA](https://help.sonatype.com/en/iq-for-idea.html "Sonatype for IDEA")
2. [Visual Studio Code](https://help.sonatype.com/en/sonatype-for-vs-code.html "Sonatype for VS Code")
3. [Eclipse](https://help.sonatype.com/en/iq-for-eclipse.html "Sonatype for Eclipse")

## The Golden PR

Sonatype IQ Server plugins for Source Control Management (SCM) can create PRs (pull request) with comments to upgrade dependencies to the recommended Golden Version. These versions are upgrade suggestions intended to remediate policy violations at or above the configured severity threshold, while minimizing the likelihood of breaking changes.

Using Golden Version recommendations can help improve the success rate of version upgrades.

**Prerequisites to view Golden PRs in the SCM system**

1. Your SCM environment has been integrated using one of the available Sonatype IQ Server plugins.
2. Check the [Sonatype Developer](https://help.sonatype.com/en/developer-dashboard.html "Developer Dashboard") dashboard to see if the application has been configured to use automatic SCM Feedback.
3. [Automated Pull Requests](https://help.sonatype.com/en/automated-pull-requests.html "Automated remediation") is enabled for the SCM.

### Viewing Golden PRs in Source Control Management Systems

The source control management platforms that currently support Golden PRs are:

- [GitHub](https://help.sonatype.com/en/golden-pr-for-github.html "Golden PR for GitHub")
- [GitLab](https://help.sonatype.com/en/golden-pr-for-gitlab.html "Golden PR for GitLab")
- [Bitbucket](https://help.sonatype.com/en/golden-pr-for-bitbucket.html "Golden PR for Bitbucket")
- [Azure DevOps](https://help.sonatype.com/en/golden-pr-for-azure-devops.html "Golden PR for Azure DevOps")

**Note**  
Automated remediation pull requests create pull requests only for Golden Versions by default.

## How is the Golden Version Different from Recommended Version?

The _Golden Version_ of a component is selected to remediate policy violations at or above the configured severity threshold on the component and its dependencies. The recommendation is intended to minimize the likelihood of breaking changes.

The recommended version of a component (seen as ‘Bumping to version xxx’ in PR comments) remediates policy violations at or above the configured severity threshold on the component itself. It may not remediate policy violations in its dependencies and validates that all transitive dependencies meet security thresholds.

When a _Golden Version_ of a component is not available, the recommended version of the component can be used as an alternative remediation option.

In API responses, this corresponds to the remediation type _recommended-non-breaking_.