This is the reason why I wrapped my Webpack config in its own package (same with Eslint), that way I pretty much only have a single dependency to add when starting or maintaining a project (and if a project has a very unique need, it can still modify the config generated by the package).

The package has a bunch of automated tests, so Dependabot checks for me if dependency updates are still compatible with the way I expect them to behave (and if a dependency needs to be swapped by another, I only need to do it in one place).