Install fails because of private repo dependencies

[SindreSau]

Hi! I tried to install the api, but i run into this behaviour. Is this the intended behaviour or is there an issue with private repositories?

[gems@gems api]$ composer install Installing dependencies from lock file (including require-dev) Verifying lock file contents can be installed on current platform. Warning: The lock file is not up to date with the latest changes in composer.json. You may be getting outdated dependencies. It is recommended that you run composer update or composer update <package name>.

• Required package "guzzlehttp/psr7" is in the lock file as "1.6.1" but that does not satisfy your constraint "^1.8.5".
• Required package "laminas/laminas-component-installer" is in the lock file as "1.1.1" but that does not satisfy your constraint "1.1.3".
• Required package "webimpress/composer-extra-dependency" is in the lock file as "0.2.2" but that does not satisfy your constraint "0.2.3".
• Required package "lcobucci/jwt" is in the lock file as "3.3.1" but that does not satisfy your constraint "3.3.3".
• Required package "jvangestel/data-set-mapper" is not present in the lock file.
• Required package "jvangestel/gems-reference-data" is not present in the lock file. This usually happens when composer files are incorrectly merged or the composer.json file is manually edited. Read more about correctly resolving merge conflicts https://getcomposer.org/doc/articles/resolving-merge-conflicts.md and prefer using the "require" command over editing the composer.json file directly https://getcomposer.org/doc/03-cli.md#require-r [gems@gems api]$ composer update Loading composer repositories with package information The authenticity of host 'github.com (140.82.121.3)' can't be established. ED25519 key fingerprint is SHA256:+DiY3wvvV6wiadohnalcwaihdn. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? Cloning failed using an ssh key for authentication, enter your GitHub credentials to access private repos When working with public GitHub repositories only, head here to retrieve a token: https://github.com/settings/tokens/new?scopes=&description=Composer+on+test.example.com+2024-06-06+1629 This token will have read-only permission for public information only. When you need to access private GitHub repositories as well, go to: https://github.com/settings/tokens/new?scopes=repo&description=Composer+on+test.example.com+2024-06-06+1629 Note that such tokens have broad read/write permissions on your behalf, even if not needed by Composer. Tokens will be stored in plain text in "/home/gems/.composer/auth.json" for future use by Composer. For additional information, check https://getcomposer.org/doc/articles/authentication-for-private-packages.md#github-oauth Token (hidden):

[jvangestel]

I believe the lock file is quite outdated in this repository. It has been tested with updated dependencies though, so a composer update would work well. The "jvangestel/data-set-mapper" and "jvangestel/gems-reference-data" packages are currently indeed private repositories. A quick fix would be to comment those out. Only specific api enpoints for those modules (in src/Ichom and src/DataSetMapper will not work, but aren't loaded by default. If needed I can update with above changes later.

Also note that https://github.com/gemstracker/gems-new-project might be a better starting point if new to gemstracker, as 2.0 is very close to release, and has updated api code integrated into the project itself (found in https://github.com/gemstracker/gems-api and https://github.com/gemstracker/gems-fhir-api