build(deps): bump guice.version from 6.0.0 to 7.0.0

[dependabot]

Bumps guice.version from 6.0.0 to 7.0.0.
Updates com.google.inject:guice from 6.0.0 to 7.0.0

Release notes

Sourced from com.google.inject:guice's releases.

Guice 7.0.0

See https://github.com/google/guice/wiki/Guice700 for release notes.

Guice 7.0.0-rc1

See https://github.com/google/guice/wiki/Guice700 for release notes.

Commits

• b0e1d0f set 7.0.0 release #s.
• f4a66b7 Make error_prone_annotations dependency optional
• 654032a Internal change.
• bee813b Improve MissingImplementationError to lazily calculate suggestions and standa...
• 2d64067 Use linked bindings for MapBinder/Multibinder/OptionalBinder aliases, instead...
• be0141c Internal change
• 40a5bcf Avoid re-initializing factories that are already initialized. This is necessa...
• 9ac4767 Change the way we reference what 6.0 supports in the README, so it doesn't ge...
• 24324ca Prepare for the Guice 6.0 & 7.0 releases. This change does the following:
• 49b1a33 Remove redundant references to javax.{inject,persistence,servlet} and replace...
• See full diff in compare view

Updates com.google.inject.extensions:guice-servlet from 6.0.0 to 7.0.0

Updates com.google.inject.extensions:guice-assistedinject from 6.0.0 to 7.0.0

Updates com.google.inject.extensions:guice-testlib from 6.0.0 to 7.0.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[FrankChen021]

Closing this upgrade because the current one-line version bump requires a repository-wide Jakarta EE migration, not a small dependency-PR fix.

Evidence and root cause:

• This PR changes only guice.version from 6.0.0 to 7.0.0 at head 9b2b22c86320ba9b3808a89557f46d3abc23bef9, based directly on current master 841faf155f0b3b5b2cbf9a29ffab1aa3d20fbbc8. Current master still uses Guice 6.0.0, so the PR is neither stale nor already covered.
• All checks are terminal: 22 failed, 3 succeeded, 2 skipped, and 1 neutral. The static checks, unit/integration matrix, and CodeQL build fail after this bump. Static, packaging, OpenRewrite, strict-compilation, web, and CodeQL builds consistently report that jakarta.servlet.ServletContextListener, jakarta.servlet.Filter, and jakarta.servlet.http.HttpServlet are unavailable while compiling druid-server. The unit matrix additionally has cascading Guice CreationException/class-initialization failures and ultimately the same server compilation errors.
• The authoritative Guice 7.0 migration notes state that Guice 7 supports only jakarta.inject, jakarta.servlet, and jakarta.persistence, removes support for the corresponding javax.* APIs, and that Guice 6 was intentionally released as the migration bridge. Guice 6 and 7 are otherwise described as identical.

Why this is high effort rather than a surgical fix:

• At this exact master, Druid has 411 javax.inject/javax.servlet/javax.persistence import statements across 178 Java source/test files and no corresponding jakarta.* imports. Affected areas include server, extensions-core, indexing-service, sql, multi-stage-query, services, processing, extensions-contrib, and quidem-ut.
• The Druid runtime stack is still explicitly on Jetty EE8 servlet modules, Jersey 1.19.4, javax.servlet-api 4.0.1, and javax.inject 1. Guice Servlet 7 instead declares jakarta.servlet-api 5.0.0 as its provided API, and Guice core 7 uses jakarta.inject-api 2.0.1. These are different package/type identities, so adding one missing JAR would not make the existing EE8/Jersey/servlet integration source- or binary-compatible.
• Completing the upgrade safely therefore requires coordinated migration of injection and servlet APIs, server bootstrap/filter/listener code, Jersey/Jetty integrations, security extensions, public/resource method signatures, dependency exclusions and distribution metadata, plus focused unit, packaging, extension, HTTP/security, and end-to-end runtime tests. Mixing javax.* and jakarta.* servlet contracts would carry substantial runtime linkage, filter/listener registration, authentication, and extension compatibility risk.

Other compatibility checks:

• Java is not the blocker: Guice 7 remains Java 8 compatible, while current Druid builds with Java 25.
• Guice 7 remains Apache License 2.0, so no new license blocker was found.
• The Guice GitHub security-advisory feed currently lists no repository advisories; this closure is for verified API incompatibility, not an unresolved advisory.

Recommended future path: keep Guice 6.0.0 until a dedicated Jakarta EE migration updates the servlet/injection stack and downstream integrations together. After that migration is green across the full build, reopen the Guice 7 upgrade as the final coordinated dependency step.

No diagnostic or speculative commits were pushed.

[FrankChen021]

false

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.