Project Maintenance Status and Recommendation to Fork

Hi everyone,

I would like to provide an update on the current maintenance status of cJSON.

As many of you may have noticed, development and maintenance activity in this repository has been very limited for quite some time.

cJSON is still widely used in many projects, and we continue to receive bug reports, pull requests, security reports, and CVE-related notifications. In recent months, the number of security reports in particular has increased significantly.

Unfortunately, the current maintainers and collaborators no longer have enough time and resources to actively maintain the project at the level that a widely used library like cJSON deserves.

Personally, I have also found it increasingly difficult to dedicate sufficient time to reviewing issues, pull requests, and security reports in a timely manner. Because of this, users should not assume that issues, security vulnerabilities, or pull requests will receive a prompt response.

This does not necessarily mean that the repository is permanently abandoned, and occasional fixes or reviews may still happen. However, at the moment, we cannot provide any reliable maintenance or response-time commitment.

Recommendation: Fork cJSON if you need active maintenance

If your project depends heavily on cJSON and requires:

• timely security fixes,
• regular bug fixes,
• active pull request review,
• new features,
• compatibility updates, or
• predictable release cycles,

I strongly recommend maintaining or adopting an actively maintained fork of cJSON.

Forking is a normal and healthy part of open-source development, especially when the original maintainers no longer have sufficient time to continue active development.

If the community develops one or more well-maintained forks, users can choose the one that best fits their requirements.

About new maintainers

One important point regarding new maintainers is that the currently active collaborators do not have the necessary administrative permissions to grant maintainer access to this repository.

Anyone interested in becoming a maintainer of the original cJSON repository would therefore need to contact the original authors or repository administrators who still have the appropriate access permissions.

That said, regardless of who ultimately has the authority to grant access, I believe new maintainers should be selected with considerable care.

cJSON is used by a very large number of downstream projects, which means that write or administrative access to this repository carries significant software supply-chain responsibility.

Incidents in the open-source ecosystem, such as the xz Utils supply-chain attack, have demonstrated the potential risks associated with transferring trust and maintainer access without sufficient scrutiny. For a widely used foundational library, repository access itself effectively becomes part of the software supply chain.

For this reason, I would recommend that any future maintainer candidates have:

• a demonstrated history of meaningful contributions to the project,
• a strong understanding of the codebase and its users,
• an established and trustworthy open-source track record,
• a clear commitment to security and backward compatibility, and
• a willingness to maintain the project over the longer term.

This is not intended to discourage contributors or people who are interested in helping maintain cJSON. On the contrary, additional contributors are very welcome.

However, I believe there should be a meaningful distinction between contributing code and being granted write or administrative access to a repository that is depended upon by such a large number of projects.

For contributors who would like to actively continue development, maintaining a fork may currently be the safest and most practical approach. Over time, actively maintained forks can establish their own track record, community, and trust.

Security reports

We will still try to review outstanding security reports when time permits, but there may be significant delays.

Pull requests that include a clear description of the problem, a reproducer or test case, and a proposed fix are especially helpful and much easier for us to review.

Please do not rely on this repository as the only path for obtaining timely security fixes.

Thank you

Finally, I would like to sincerely thank everyone who has contributed to cJSON over the years — maintainers, contributors, security researchers, package maintainers, and users.

cJSON has grown far beyond what its original maintainers could have expected, and its continued use across so many projects is something the community can be proud of.

At the same time, it is important to be transparent about the current reality: the project no longer has enough active maintainer capacity to guarantee ongoing maintenance.

For users who require active development and security support, forking cJSON and continuing maintenance independently is currently the recommended path.

Thank you for your understanding.