handle private repos also for dependencies