Composer install --no-dev not working as expected

I’m building a plugin which uses a composer package.

I have followed the instructions and found an example of what the compose.json file should look like.
This is to copy a composer.json file into the following directory custom/Extension/application/Ext/Composer/*/*.json
I named my file composer.json and the parent folder it is in is called <MY_PLUGIN_NAME>

after the module is installed from module loader. I can see I need to run composer install --no-dev

when doing this I get the following message:
Installing dependencies from lock file
Verifying lock file contents can be installed on current platform.
Warning: The lock file is not up to date with the latest changes in composer.json. You may be getting outdated dependencies. It is recommended that you run composer update or composer update <package name>.

  • Required package “stripe/stripe-php” is not present in the lock file.
    This usually happens when composer files are incorrectly merged or the composer.json file is manually edited.

This step isn’t documented which makes me think there is a problem.
However when running composer update stripe/stripe-php This installs the package as expected.

what is the correct way to install a composer package from a module so that I can make sure I make valid post_install, and post_uninstall scripts for my package

I don’t know what happened but here a a few things that might help you figure things out.

  1. Try composer with “dry runs” to see what it shows:

composer update --dry-run

  1. Check that you have composer merge-plugin operational. If you check the composer.json that comes with SuiteCRM, you’ll find this:
    "merge-plugin": {
      "include": [
        "composer.ext.json",
        "custom/Extension/application/Ext/Composer/*/*.json"
      ],

This is what causes your file to be picked up, if you have the plugin installed. You can check with

composer show “wikimedia/composer-merge-plugin”