We've seen that Dependabot does better at updating PHP dependencies in the composer.json.
Also, now that we have a GitHub action which does ZIP builds for PRs, this is restricted to PRs not coming from forks, which is another benefit that Dependabot provides.
Therefore, we should decommission Renovate and switch instead to Dependabot.
_Do not alter or remove anything below. The following sections will be managed by moderators only._
FYI: Renovate has now been disabled for amp-wp.
@schlessera It has also been disabled for amp-toolbox-php.
Please let me know if you see any issues following disable.
Only outstanding issue is needing to add dependabot-preview to the CLAassistant allowlist:

^ Coincidentally just asked about this in the #wg-infra Slack channel.
Thanks to @kristoferbaxter and @rsimha, dependabot is now in the allowlist for the CLA.
The check is passing:

https://github.com/ampproject/amp-wp/pulls/app%2Fdependabot-preview
Most helpful comment
Thanks to @kristoferbaxter and @rsimha, dependabot is now in the allowlist for the CLA.
The check is passing:
https://github.com/ampproject/amp-wp/pulls/app%2Fdependabot-preview