Decimal < 3.0 Security Vulnerability

[merhard]

Can the (optional) Decimal dependency be widened to allow ~> 3.0 and a new version released so the following security vulnerability can be addressed? GHSA-rhv4-8758-jx7v