If you use private repositories mentioned in the composer.json
of a dependency of your main package, you have to repeat them there.
Alternatively you can set up an instance of Satis to create the necessary metadata from all the private repositories you use, and simply link this instead.
Composer will NOT recursively scan repositories for further links to other repositories, because that would lead to infinite scan times and really poor performance, and ultimately to undecidable problems as well, so whatever package you are using has to either only use Packagist as a source, or must mention the source for all packages that should override or add to Packagist.
Having one single Satis instance that acts as a complete map of all your private repositories will really ease the process.