There is now a decision from the ASF VP Legal to move the JSON library to "Category X" and therefore forbid its inclusion in released. It's a good opportunity for us to evaluate another, more mainstream, JSON library.
As of r1771785, the following modules declare a dependency on org.json or - in the case of commons.long - embed source code from it
Home page: http://johnzon.apache.org/
- Is not OSGi ready, see dev@johnzon: Using johnzon-core in an OSGi container
Home page: https://github.com/google/gson
Home page: https://github.com/FasterXML/jackson
Home page: https://jsonp.java.net/
- Roy mentioned: "Do not import any Glassfish code into Apache"
Actually a clean room implementation of the org.json API taken from the Android project.
Home page: https://github.com/tdunning/open-json
- Is not OSGi ready
- I think it uses the same package names as the original json.org library, we also do that and ours has slightly different behavior, the whole thing might get more confusing than just switching to something else.