I do not believe the potential costs and risks of vendoring json here outweight the benefit of avoiding asking the user to install it.