Proposal: Introduce Renovate for automated dependency management

[gtg7784]

Proposal

How about introducing Renovate to automate dependency management?

Background

• Currently managing dependency updates manually
• Hard to immediately notice security patches or new versions

Benefits of Renovate

1. Automatic PR creation: Auto-generates update PRs when new versions are released
2. Grouping: Bundle related packages into a single PR
3. Scheduling: Configure PRs to be created only at preferred times
4. Security vulnerability alerts: Prioritize packages with security issues
5. Automatic lockfile updates: Auto-updates bun.lock

Suggested Configuration

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "packageRules": [
    {
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    }
  ]
}

Alternative

• Dependabot: GitHub native but less flexible configuration than Renovate

---

Thoughts?

[gtg7784]

It'll automatically manage dependency versions and create PR like this gtg7784/solana-kms-signer#29