How do you handle Helm chart version pinning across 20+ microservices?

Running a K8s cluster with 20+ services, each with its own Helm chart. We've hit the problem where chart dependencies drift — one service pins nginx-ingress 4.0.1, another uses 4.2.0, and the shared values overlap in unexpected ways. Approaches we're weighing: 1. Single umbrella chart with subcharts (monorepo-style) 2. Centralized values repo with renovate-bot PRs per chart 3. Chart-testing in CI with matrix builds What's your setup? How do you avoid dependency hell when upstream chart authors bump major versions at different cadences?