How to connect private repositories to dependencies in Composer?

Question

PHP

We use Composer to include shared libs in projects. The libs themselves lie as separate private repositories in GitLab.
Usually connected like this:

{
  "require": {
    "yiisoft/yii": "1.1.15",
    "thc/hotels-catalog-rest-client": "dev-master"
  },
  "config": {
    "vendor-dir": "protected/vendor"
  },
  "repositories": [
    {
      "type": "git",
      "url": "http://gitlab.thcdev.ru/thc/hotels-catalog-rest-client.git"
    }
  ]
}

For private projects that are not in Packagist, I set the path to the repository manually.
But now this lib depends on another private lib.

{
    "name": "thc/hotels-catalog-rest-client",
    "description": "Hotels Catalog Api Client",
    "classmap": ["/"],
    "require": {
    "thc/yii1-rest-client": "dev-master"
  },
  "repositories":[
        {
            "type":"git",
            "url":"http://gitlab.thcdev.ru/thc/yii1-rest-client.git"
        }
    ]
}

And the composer flatly refuses to see her.

Problem 1
- thc/hotels-catalog-rest-client dev-master requires thc/yii1-rest-client dev-master -> no matching package found.
- thc/hotels-catalog-rest-client dev-master requires thc/yii1-rest-client dev-master -> no matching package found.
- Installation request for thc/hotels-catalog-rest-client dev-master -> satisfiable by thc/hotels-catalog-rest-client[dev-master].
Potential causes:
- A typo in the package name
- The package is not available in a stable-enough version according to your minimum-stability setting
see for more details.
Read for further common problems.

I assumed that this is due to the fact that the Composer does not read the repositories section of dependencies (because in this way you can compromise someone else's project by substituting dependencies with backdoors in your repository)
And transferred the repository from the child dependency to the main file. those. like this:

{
  "require": {
    "yiisoft/yii": "1.1.15",
    "thc/hotels-catalog-rest-client": "dev-master"
  },
  "config": {
    "vendor-dir": "protected/vendor"
  },
  "repositories": [
    {
      "type": "git",
      "url": "http://gitlab.thcdev.ru/thc/hotels-catalog-rest-client.git"
    },
 {
      "type": "git",
     "url":"http://gitlab.thcdev.ru/thc/yii1-rest-client.git"
    }
  ]
}

but the result is the same. Composer flatly refuses to see the nested dependency.
Does anyone know how to solve this?
PS
Moreover, if all these dependencies are transferred to the main project, i.e. like this:

{
  "require": {
    "yiisoft/yii": "1.1.15",
    "thc/hotels-catalog-rest-client": "dev-master",
    "thc/yii1-rest-client": "dev-master"
  },
  "config": {
    "vendor-dir": "protected/vendor"
  },
  "repositories": [
    {
      "type": "git",
      "url": "http://gitlab.thcdev.ru/thc/hotels-catalog-rest-client.git"
    },
 {
      "type": "git",
     "url":"http://gitlab.thcdev.ru/thc/yii1-rest-client.git"
    }
  ]
}

That all works. But why do we need a dependency manager then, if everything is written by hand?

Answer 1

https://toranproxy.com/ try this. Easy to install, eliminates the above problems. Can fully proxy all packages or be used only for private repositories. It has a web interface for adding new private repositories, which is very convenient.

Answer 2

https://getcomposer.org/doc/04-schema.md#repositories
I found in the documentation that the repositories section is root-only, i.e. all sections of repositories defined in all dependencies are ignored.
I followed the right path, but it's still not clear why writing my repository in the root composer.json did not work.