if the action runs and there's already an open dependencies PR, it seems to force-push over any additional commits that were added manually since the last time the action ran.
it would be nice if instead it either kept the commits as-is and pushed a new one on top of the existing ones, or it could fixup & rebase the original commit, leaving the commits after it intact.