The cJSON dependency / build configuration has been quite painful; I will defend the current setup in roughly five seconds before I bend over to a better solution.

But anyway - the situation is as follows:

 1. opm-parser requires cJSON, but build system-wise this is not a required dependency. If cJSON is not found during the opm-parser configure phase opm-parser will build and install libcjson itself.
 2. So - after the opm-parser build process is complete our system must have opm-parser (obviously), and cJSON - where the latter either is found on the system (no - it is never found); or built as part of the opm-parser build process.

So - all in all it is the first user of opm-parser which will also require cJSON. I agree that the two mentioned lines could be interchanged; or even better:

    "opm-parser cJSON REQUIRED"

To clearly indicate that they typically come as lump. But as I said - will not fight for this.