Install fails because of private repo dependencies

[SindreSau]

Hi! I tried to install the api, but i run into this behaviour. Is this the intended behaviour or is there an issue with private repositories?

[gems@gems api]$ composer install
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Warning: The lock file is not up to date with the latest changes in composer.json. You may be getting outdated dependencies. It is recommended that you run composer update or composer update <package name>.

• Required package "guzzlehttp/psr7" is in the lock file as "1.6.1" but that does not satisfy your constraint "^1.8.5".
• Required package "laminas/laminas-component-installer" is in the lock file as "1.1.1" but that does not satisfy your constraint "1.1.3".
• Required package "webimpress/composer-extra-dependency" is in the lock file as "0.2.2" but that does not satisfy your constraint "0.2.3".
• Required package "lcobucci/jwt" is in the lock file as "3.3.1" but that does not satisfy your constraint "3.3.3".
• Required package "jvangestel/data-set-mapper" is not present in the lock file.
• Required package "jvangestel/gems-reference-data" is not present in the lock file.
  This usually happens when composer files are incorrectly merged or the composer.json file is manually edited.
  Read more about correctly resolving merge conflicts https://getcomposer.org/doc/articles/resolving-merge-conflicts.md
  and prefer using the "require" command over editing the composer.json file directly https://getcomposer.org/doc/03-cli.md#require-r
  [gems@gems api]$ composer update
  Loading composer repositories with package information
  The authenticity of host 'github.com (140.82.121.3)' can't be established.
  ED25519 key fingerprint is SHA256:+DiY3wvvV6wiadohnalcwaihdn.
  This key is not known by any other names
  Are you sure you want to continue connecting (yes/no/[fingerprint])?
  Cloning failed using an ssh key for authentication, enter your GitHub credentials to access private repos
  When working with public GitHub repositories only, head here to retrieve a token:
  https://github.com/settings/tokens/new?scopes=&description=Composer+on+test.example.com+2024-06-06+1629
  This token will have read-only permission for public information only.
  When you need to access private GitHub repositories as well, go to:
  https://github.com/settings/tokens/new?scopes=repo&description=Composer+on+test.example.com+2024-06-06+1629
  Note that such tokens have broad read/write permissions on your behalf, even if not needed by Composer.
  Tokens will be stored in plain text in "/home/gems/.composer/auth.json" for future use by Composer.
  For additional information, check https://getcomposer.org/doc/articles/authentication-for-private-packages.md#github-oauth
  Token (hidden):

[jvangestel]

I believe the lock file is quite outdated in this repository. It has been tested with updated dependencies though, so a composer update would work well.
The "jvangestel/data-set-mapper" and "jvangestel/gems-reference-data" packages are currently indeed private repositories. A quick fix would be to comment those out. Only specific api enpoints for those modules (in src/Ichom and src/DataSetMapper will not work, but aren't loaded by default.
If needed I can update with above changes later.

Also note that https://github.com/gemstracker/gems-new-project might be a better starting point if new to gemstracker, as 2.0 is very close to release, and has updated api code integrated into the project itself (found in https://github.com/gemstracker/gems-api and https://github.com/gemstracker/gems-fhir-api