OpenWhisk uses a non-OSS friendly version of org.json:json jar

[pjfanning]

openwhisk-devtools/knative-build/runtimes/java/WhiskSim/pom.xml

Line 53 in 5801dc2

<version>20190722</version>

See https://www.apache.org/legal/resolved.html (JSON license section)

Could you upgrade to a newer version? And these versions have security fixes too.

Since late 2022, this jar is now properly in the public domain.

[dgrove-oss]

The knative-build part of this repo was experimental and isn't actively maintained. Most likely the right thing is just to remove it entirely.