diff --git a/MAINTENANCE.md b/MAINTENANCE.md
index bdc4585..bb39d3b 100644
--- a/MAINTENANCE.md
+++ b/MAINTENANCE.md
@@ -4,7 +4,21 @@ All contributions should be made via pull requests.
 
 ## Pull Requests
 
-A pull request can be merged directly into `main` by any maintainer. No approval is needed, but pull requests should be tested as working before merge.
+A pull request can be merged directly into `main` by any maintainer. 
+No approval is needed, but pull requests should be tested as working before merge.
+
+## Dependency Updates
+
+- patch updates proposed from renovate bot are merged directly - 
+  if there is a CVE, also release a new patch version of this recipe
+- minor updates proposed from renovate bot are tested by one maintainer 
+  and merged if they don't break, then a new minor version of the recipe 
+  is released
+- major updates proposed form renovate bot are tested by two maintainers 
+  and merged if they don't break, then a major version of the recipe is 
+  released. 
+  If the renovate bot PR is older than one week, one maintainer can decide
+  to merge it anyway. 
 
 ## Become a maintainer
 
diff --git a/compose.yml b/compose.yml
index f20de8f..990bde6 100644
--- a/compose.yml
+++ b/compose.yml
@@ -95,14 +95,14 @@ services:
 
   app:
     user: "${DOCKER_USER:-1000}"
-    image: lasuite/drive-frontend:v0.24.0
+    image: lasuite/drive-frontend:v0.25.2
     networks:
       - backend
     deploy:
       labels:
         - "traefik.enable=false"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.13.2+v0.22.0"
+        - "coop-cloud.${STACK_NAME}.version=0.13.3+v0.22.0"
     environment:
       <<: [ *common-env ]
     healthcheck:
@@ -116,7 +116,7 @@ services:
 
   backend:
     user: ${DOCKER_USER:-1000}
-    image: lasuite/drive-backend:v0.24.0
+    image: lasuite/drive-backend:v0.25.2
     command: [ "gunicorn", "-c", "/usr/local/etc/gunicorn/drive.py", "drive.wsgi:application" ]
     entrypoint: >
       sh -c "if [ \"$$AUTO_MIGRATIONS\" = \"true\" ]; then /migrate.sh; fi && exec /abra-entrypoint.sh /usr/local/bin/entrypoint \"$$@\"" --
@@ -145,7 +145,7 @@ services:
 
   celery:
     user: ${DOCKER_USER:-1000}
-    image: lasuite/drive-backend:v0.24.0
+    image: lasuite/drive-backend:v0.25.2
     networks:
       - backend
     command: [ "celery", "-A", "drive.celery_app", "worker", "-l", "INFO" ]
@@ -167,7 +167,7 @@ services:
 
   celery-beat:
     user: ${DOCKER_USER:-1000}
-    image: lasuite/drive-backend:v0.24.0
+    image: lasuite/drive-backend:v0.25.2
     networks:
       - backend
     command: [ "celery", "-A", "drive.celery_app", "beat", "-l", "INFO", "--schedule", "/tmp/celerybeat-schedule" ]
@@ -274,9 +274,9 @@ services:
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   collabora:
-    image: collabora/code:26.04.4.2.1
-    # 26.04 images exec coolwsd directly (--use-env-vars; no shell in the image),
-    # so ssl options are passed as args and the panel password comes from the env.
+    image: collabora/code:26.04.5.1.1
+    # 26.04 images exec coolwsd directly (no shell in the image), so ssl options are passed as
+    # args and the panel password comes from the env instead of a Docker secret.
     command: ["--o:ssl.enable=false", "--o:ssl.termination=true"]
     healthcheck:
       test: [ "CMD", "/usr/bin/coolwsd", "--probe", "--o:ssl.enable=false" ]
@@ -309,7 +309,7 @@ services:
       - "traefik.http.routers.${STACK_NAME}_collabora.middlewares=${STACK_NAME}_collabora-cors"
 
   onlyoffice:
-    image: onlyoffice/documentserver-de:9.4.1.2
+    image: onlyoffice/documentserver-de:10.0.0.1
     healthcheck:
       test: [ "CMD", "curl", "-f", "http://localhost/hosting/discovery" ]
       interval: 30s
@@ -348,7 +348,7 @@ services:
 
 
   web:
-    image: nginx:1.31.7
+    image: nginx:1.31.8
     configs:
       - source: nginx_conf
         target: /etc/nginx/conf.d/default.conf