Why Sonic?

[gregriff]

Recently I evaluated Gin for use in a personal project. I was surprised to see that the first dependency of Gin is sonic, a JSON serialization/de-serialization package developed by the Chinese company Bytedance.

41% of the Sonic repository is Assembly. Almost every file I viewed used the unsafe package. Given that this package is used to validate user input (probably the most common attack vector), is this not a security concern for users of Gin?