Which has better activity and maintenance signals?

Based on the RepoPilot analysis and release history provided:

stleary/json-java shows stronger recent maintenance signals:

• Active release cadence: The release history in [docs/RELEASES.md:L1-L71] shows frequent recent releases, including:

  • 20260814 (Fixes XML.unescape whitespace handling)
  • 20260719 (Fixes CVE-2026-59171 for very large BigInteger, BigDecimal)
  • 20251224, 20250517, 20250107 (all recent releases)

• Security responsiveness: Proactive CVE fixes documented (CVE-2023-5072, CVE-2022-45688)

• Health verdict: RepoPilot marks it as "GO — Healthy across the board"

• CI/CD: Active GitHub Actions workflows for CodeQL analysis and Maven builds [.github/workflows/codeql-analysis.yml]

• Community governance: Documented contribution guidelines [docs/CONTRIBUTING.md:L7-L10] and Code of Conduct

xuxueli/xxl-job appears less actively maintained in the provided data:

• The repository data shows no recent release history or version timeline
• No security advisory information is visible in the excerpt
• The code examples appear to be from internal scheduler/alarm components rather than showing recent activity patterns

Conclusion: stleary/json-java demonstrates better maintenance signals with frequent releases, documented security fixes, active CI/CD, and explicit community governance—characteristics of a well-maintained reference library. xuxueli/xxl-job's activity level cannot be as clearly assessed from the provided data.

FOLLOW_UPS:

• What are stleary/json-java's Java version support requirements?
• How does xuxueli/xxl-job handle distributed task scheduling failures?
• What CVEs have been fixed in json-java recently?