Why does it take up to two minutes for my composer dependencies to update, even when there have been no changes?
A popular suggestion is to append the --prefer-
You are using a private repository. This will not allow to download zipped version of the version you include, but must clone the repository. Additionally, it might be that the whole repository must be scanned to find the required version.
You should check whether using Satis is an option. That way you could prepare ZIPs of your own software and download it just like the things hosted on Github (which has an API for this that is used by Composer to allow downloading ZIPs even if they are not explicitly prepared).