That's right. Composer only reads repositories from the root JSON file. This ...

That's right. Composer only reads repositories from the root JSON file. This means that you may require the library you add but it won't work until the package is added in the main composer.json file. It is a useful thing which could be documented in README perhaps but if this is now in composer.json, I would suggest that it should be removed. It gives a wrong impression that it works without the root JSON file changes.