add renovate json file

CONTRIBUTING.md

@@ -33,6 +33,7 @@ Thanks for taking the time to contribute! :smile:
   - [Branches](#branches)
   - [Pull Requests](#pull-requests)
   - [Testing](#testing)
+  - [Dependencies](#dependencies)
 - [Deployment](#deployment)
 
 ## CI status
@@ -338,6 +339,10 @@ This repository is exhaustively tested by [CircleCI](https://circleci.com/gh/cyp
 
 To run local tests, consult the `README.md` of each package.
 
+### Dependencies
+
+We use [RenovateBot](https://renovatebot.com/) to automatically upgrade our dependencies. The bot keeps chugging using settings in [renovate.json](renovate.json) to open PRs and if they pass merge patches. Minor and major updates require manual merge.
+
 ## Deployment
 
 We will try to review and merge pull requests quickly. After merging we

renovate.json

@@ -0,0 +1,24 @@
+{
+  "extends": [
+    "config:base"
+  ],
+  "automerge": true,
+  "major": {
+    "automerge": false
+  },
+  "minor": {
+    "automerge": false
+  },
+  "rangeStrategy": "pin",
+  "separateMultipleMajor": true,
+  "labels": ["type: dependencies"],
+  "commitMessage": "{{semanticPrefix}}Update {{depName}} to {{newVersion}} 🌟",
+  "prTitle": "{{semanticPrefix}}{{#if isPin}}Pin{{else}}Update{{/if}} dependency {{depName}} to version {{#if isRange}}{{newVersion}}{{else}}{{#if isMajor}}{{newVersionMajor}}.x{{else}}{{newVersion}}{{/if}}{{/if}} 🌟",
+  "prHourlyLimit": 1,
+  "updateNotScheduled": false,
+  "timezone": "America/New_York",
+  "schedule": [
+    "after 10pm and before 5am on every weekday",
+    "every weekend"
+  ]
+}