This config won't track crates.io releases of the SDK as intended. In Cargo.toml:20, hotdata is a git dependency pinned to a rev:

hotdata = { git = "https://github.com/hotdata-dev/sdk-rust", rev = "1687ba2...", features = ["arrow"] }

Dependabot resolves updates from a dependency's declared source, not crates.io. Since the manifest sources hotdata from git, a crates.io publish is invisible to this config — the premise in the PR description and the header comment ("when a new version is published to crates.io") doesn't hold here.

For a git dependency, Dependabot's cargo updater only advances deps that track a branch (to the latest commit) or a tag; it does not reliably bump a dependency pinned to an explicit rev. So as written this is likely to open no PRs at all. And if it did advance the rev, it would bump to arbitrary default-branch commits — which directly conflicts with the deliberately pinned rev documented in Cargo.toml (the comment there explains this exact rev is the first to carry content_length on upload_stream).

To achieve the stated goal you'd need to either (a) switch the SDK to a crates.io dependency (hotdata = "x.y"), then this config works as described, or (b) track the git source explicitly (e.g. point the dep at a branch/tag and accept that Dependabot follows git, not crates.io). Please reconcile the config with how the dependency is actually sourced.