feat(spec): replace rust_decimal with fastnum for 38-digit precision (#2063)

## Summary

Replace rust_decimal with fastnum::D128 to support 38-digit decimal
precision as required by the Iceberg spec, addressing issue #669.

## Changes

- Add `crates/iceberg/src/spec/values/decimal_utils.rs` with:
- Compatibility layer providing rust_decimal-like API using
fastnum::D128
- `decimal_from_i128_with_scale()`, `decimal_mantissa()`,
`decimal_scale()` helpers
- `i128_from_be_bytes()` / `i128_to_be_bytes_min()` for binary
serialization
- Unit tests for all helper functions including 38-digit precision
validation

- Update `Cargo.toml` (workspace and iceberg crate):
  - Add fastnum dependency with std and serde features
  - Remove rust_decimal, num-bigint, num-traits dependencies

- Update `crates/iceberg/src/spec/values/datum.rs`:
  - Replace rust_decimal imports with decimal_utils
  - Update `from_bytes()` and `to_bytes()` for new decimal API
  - Update `decimal_with_precision()` validation

- Update `crates/iceberg/src/spec/values/literal.rs`:
  - Update JSON serialization/deserialization for decimals

- Update `crates/iceberg/src/transform/bucket.rs` and `truncate.rs`:
  - Update decimal transform implementations

- Update `crates/iceberg/src/arrow/schema.rs` and `parquet_writer.rs`:
  - Update Arrow/Parquet decimal statistics handling
  - Replace `BigInt` byte conversions with helper functions

- Update `.cargo/audit.toml`:
- Remove RUSTSEC-2024-0399 ignore (rust_decimal vulnerability no longer
applies)

## Notes

fastnum::D128 provides exactly 38-digit precision with stack-based
storage (no heap allocation), meeting the Iceberg spec requirement that
rust_decimal (28-digit max) could not satisfy.

The decimal_utils module abstracts the API differences between
rust_decimal and fastnum, making the migration transparent to the rest
of the codebase.

Closes #669

Author: xbattlax

.cargo/audit.toml

@@ -33,7 +33,4 @@ ignore = [
   #
   # Introduced by object_store, see https://github.com/apache/arrow-rs-object-store/issues/564
   "RUSTSEC-2025-0134",
-
-  # Tracked here: https://github.com/paupino/rust-decimal/issues/766
-  "RUSTSEC-2026-0001",
 ]

Cargo.lock

@@ -97,7 +97,6 @@ mockall = "0.13.1"
 mockito = "1"
 motore-macros = "0.4.3"
 murmur3 = "0.5.2"
-num-bigint = "0.4.6"
 once_cell = "1.20"
 opendal = "0.55.0"
 ordered-float = "4"
@@ -108,7 +107,7 @@ rand = "0.8.5"
 regex = "1.11.3"
 reqwest = { version = "0.12.12", default-features = false, features = ["json"] }
 roaring = { version = "0.11" }
-rust_decimal = { version = "1.39", default-features = false, features = ["std"] }
+fastnum = { version = "0.7", default-features = false, features = ["std", "serde"] }
 serde = { version = "1.0.219", features = ["rc"] }
 serde_bytes = "0.11.17"
 serde_derive = "1.0.219"

Cargo.toml

@@ -37,8 +37,6 @@ pyo3 = { version = "0.26", features = ["extension-module", "abi3-py310"] }
 iceberg-datafusion = { path = "../../crates/integrations/datafusion" }
 datafusion-ffi = { version = "51.0" }
 tokio = { version = "1.46.1", default-features = false }
-# Security: disable rkyv feature to avoid RUSTSEC-2026-0001 (rkyv 0.7.45 vulnerability)
-rust_decimal = { version = "1.39", default-features = false, features = ["std"] }
 
 [profile.release]
 codegen-units = 1
@@ -48,5 +46,4 @@ opt-level = "z"
 strip = true
 
 [package.metadata.cargo-machete]
-# rust_decimal is included to override feature flags for security (disable rkyv)
-ignored = ["rust_decimal"]
+ignored = []

bindings/python/Cargo.toml

@@ -67,7 +67,6 @@ futures = { workspace = true }
 itertools = { workspace = true }
 moka = { version = "0.12.10", features = ["future"] }
 murmur3 = { workspace = true }
-num-bigint = { workspace = true }
 once_cell = { workspace = true }
 opendal = { workspace = true }
 ordered-float = { workspace = true }
@@ -76,7 +75,7 @@ rand = { workspace = true }
 reqsign = { version = "0.16.3", optional = true, default-features = false }
 reqwest = { workspace = true }
 roaring = { workspace = true }
-rust_decimal = { workspace = true }
+fastnum = { workspace = true }
 serde = { workspace = true }
 serde_bytes = { workspace = true }
 serde_derive = { workspace = true }

crates/iceberg/Cargo.toml

@@ -27,13 +27,12 @@ use arrow_array::{
     TimestampMicrosecondArray,
 };
 use arrow_schema::{DataType, Field, Fields, Schema as ArrowSchema, TimeUnit};
-use num_bigint::BigInt;
 use parquet::arrow::PARQUET_FIELD_ID_META_KEY;
 use parquet::file::statistics::Statistics;
-use rust_decimal::prelude::ToPrimitive;
 use uuid::Uuid;
 
 use crate::error::Result;
+use crate::spec::decimal_utils::i128_from_be_bytes;
 use crate::spec::{
     Datum, FIRST_FIELD_ID, ListType, MapType, NestedField, NestedFieldRef, PrimitiveLiteral,
     PrimitiveType, Schema, SchemaVisitor, StructType, Type,
@@ -680,7 +679,8 @@ impl SchemaVisitor for ToArrowSchemaConverter {
                 DataType::FixedSizeBinary(16),
             )),
             crate::spec::PrimitiveType::Fixed(len) => Ok(ArrowSchemaOrFieldOrType::Type(
-                len.to_i32()
+                i32::try_from(*len)
+                    .ok()
                     .map(DataType::FixedSizeBinary)
                     .unwrap_or(DataType::LargeBinary),
             )),
@@ -722,10 +722,10 @@ pub(crate) fn get_arrow_datum(datum: &Datum) -> Result<Arc<dyn ArrowDatum + Send
             Ok(Arc::new(Int64Array::new_scalar(*value)))
         }
         (PrimitiveType::Float, PrimitiveLiteral::Float(value)) => {
-            Ok(Arc::new(Float32Array::new_scalar(value.to_f32().unwrap())))
+            Ok(Arc::new(Float32Array::new_scalar(value.into_inner())))
         }
         (PrimitiveType::Double, PrimitiveLiteral::Double(value)) => {
-            Ok(Arc::new(Float64Array::new_scalar(value.to_f64().unwrap())))
+            Ok(Arc::new(Float64Array::new_scalar(value.into_inner())))
         }
         (PrimitiveType::String, PrimitiveLiteral::String(value)) => {
             Ok(Arc::new(StringArray::new_scalar(value.as_str())))
@@ -835,10 +835,9 @@ pub(crate) fn get_parquet_stat_min_as_datum(
             let Some(bytes) = stats.min_bytes_opt() else {
                 return Ok(None);
             };
-            let unscaled_value = BigInt::from_signed_bytes_be(bytes);
             Some(Datum::new(
                 primitive_type.clone(),
-                PrimitiveLiteral::Int128(unscaled_value.to_i128().ok_or_else(|| {
+                PrimitiveLiteral::Int128(i128_from_be_bytes(bytes).ok_or_else(|| {
                     Error::new(
                         ErrorKind::DataInvalid,
                         format!("Can't convert bytes to i128: {bytes:?}"),
@@ -982,10 +981,9 @@ pub(crate) fn get_parquet_stat_max_as_datum(
             let Some(bytes) = stats.max_bytes_opt() else {
                 return Ok(None);
             };
-            let unscaled_value = BigInt::from_signed_bytes_be(bytes);
             Some(Datum::new(
                 primitive_type.clone(),
-                PrimitiveLiteral::Int128(unscaled_value.to_i128().ok_or_else(|| {
+                PrimitiveLiteral::Int128(i128_from_be_bytes(bytes).ok_or_else(|| {
                     Error::new(
                         ErrorKind::DataInvalid,
                         format!("Can't convert bytes to i128: {bytes:?}"),
@@ -1295,9 +1293,9 @@ mod tests {
     use std::sync::Arc;
 
     use arrow_schema::{DataType, Field, Schema as ArrowSchema, TimeUnit};
-    use rust_decimal::Decimal;
 
     use super::*;
+    use crate::spec::decimal_utils::decimal_new;
     use crate::spec::{Literal, Schema};
 
     /// Create a simple field with metadata.
@@ -2127,7 +2125,7 @@ mod tests {
             assert_eq!(array.value(0), 42);
         }
         {
-            let datum = Datum::decimal_with_precision(Decimal::new(123, 2), 30).unwrap();
+            let datum = Datum::decimal_with_precision(decimal_new(123, 2), 30).unwrap();
             let arrow_datum = get_arrow_datum(&datum).unwrap();
             let (array, is_scalar) = arrow_datum.get();
             let array = array.as_any().downcast_ref::<Decimal128Array>().unwrap();

crates/iceberg/src/arrow/schema.rs

@@ -408,12 +408,6 @@ define_from_err!(
     "Failed to parse json string"
 );
 
-define_from_err!(
-    rust_decimal::Error,
-    ErrorKind::DataInvalid,
-    "Failed to convert decimal literal to rust decimal"
-);
-
 define_from_err!(
     parquet::errors::ParquetError,
     ErrorKind::Unexpected,

crates/iceberg/src/error.rs

@@ -52,6 +52,7 @@ pub use table_metadata::*;
 pub(crate) use table_metadata_builder::FIRST_FIELD_ID;
 pub use table_properties::*;
 pub use transform::*;
+pub(crate) use values::decimal_utils;
 pub use values::*;
 pub use view_metadata::*;
 pub use view_version::*;

crates/iceberg/src/spec/mod.rs

@@ -24,6 +24,7 @@ use std::str::FromStr;
 use fnv::FnvHashSet;
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
 
+use super::values::decimal_utils::decimal_from_i128_with_scale;
 use super::{Datum, PrimitiveLiteral};
 use crate::ErrorKind;
 use crate::error::{Error, Result};
@@ -660,7 +661,7 @@ impl Transform {
                 (PrimitiveType::Int, PrimitiveLiteral::Int(v)) => Some(Datum::int(v - 1)),
                 (PrimitiveType::Long, PrimitiveLiteral::Long(v)) => Some(Datum::long(v - 1)),
                 (PrimitiveType::Decimal { .. }, PrimitiveLiteral::Int128(v)) => {
-                    Some(Datum::decimal(v - 1)?)
+                    Some(Datum::decimal(decimal_from_i128_with_scale(v - 1, 0))?)
                 }
                 (PrimitiveType::Date, PrimitiveLiteral::Int(v)) => Some(Datum::date(v - 1)),
                 (PrimitiveType::Timestamp, PrimitiveLiteral::Long(v)) => {
@@ -672,7 +673,7 @@ impl Transform {
                 (PrimitiveType::Int, PrimitiveLiteral::Int(v)) => Some(Datum::int(v + 1)),
                 (PrimitiveType::Long, PrimitiveLiteral::Long(v)) => Some(Datum::long(v + 1)),
                 (PrimitiveType::Decimal { .. }, PrimitiveLiteral::Int128(v)) => {
-                    Some(Datum::decimal(v + 1)?)
+                    Some(Datum::decimal(decimal_from_i128_with_scale(v + 1, 0))?)
                 }
                 (PrimitiveType::Date, PrimitiveLiteral::Int(v)) => Some(Datum::date(v + 1)),
                 (PrimitiveType::Timestamp, PrimitiveLiteral::Long(v)) => {
@@ -806,7 +807,9 @@ impl Transform {
         match (datum.data_type(), datum.literal()) {
             (PrimitiveType::Int, PrimitiveLiteral::Int(v)) => Ok(Datum::int(v + 1)),
             (PrimitiveType::Long, PrimitiveLiteral::Long(v)) => Ok(Datum::long(v + 1)),
-            (PrimitiveType::Decimal { .. }, PrimitiveLiteral::Int128(v)) => Datum::decimal(v + 1),
+            (PrimitiveType::Decimal { .. }, PrimitiveLiteral::Int128(v)) => {
+                Datum::decimal(decimal_from_i128_with_scale(v + 1, 0))
+            }
             (PrimitiveType::Date, PrimitiveLiteral::Int(v)) => Ok(Datum::date(v + 1)),
             (PrimitiveType::Timestamp, PrimitiveLiteral::Long(v)) => {
                 Ok(Datum::timestamp_micros(v + 1))
@@ -842,7 +845,9 @@ impl Transform {
         match (datum.data_type(), datum.literal()) {
             (PrimitiveType::Int, PrimitiveLiteral::Int(v)) => Ok(Datum::int(v - 1)),
             (PrimitiveType::Long, PrimitiveLiteral::Long(v)) => Ok(Datum::long(v - 1)),
-            (PrimitiveType::Decimal { .. }, PrimitiveLiteral::Int128(v)) => Datum::decimal(v - 1),
+            (PrimitiveType::Decimal { .. }, PrimitiveLiteral::Int128(v)) => {
+                Datum::decimal(decimal_from_i128_with_scale(v - 1, 0))
+            }
             (PrimitiveType::Date, PrimitiveLiteral::Int(v)) => Ok(Datum::date(v - 1)),
             (PrimitiveType::Timestamp, PrimitiveLiteral::Long(v)) => {
                 Ok(Datum::timestamp_micros(v - 1))