cms框架的composer.lock地址版本太旧，api.github.com的zip地址从哪找

问题

安装laravel类型cms框架时，执行composer install，提示关联包无法下载

原因

composer.lock中包太旧了，需要换成新的，包为github地址

求问

1. source中的reference从哪来的，怎么找
2. url中的api.github.com是怎么得来的

代码

    {
        "name": "symfony/process",
        "version": "3.4.x-dev",
        "source": {
            "type": "git",
            "url": "https://github.com/symfony/process.git",
            "reference": "009f8dda80930e89e8344a4e310b08f9ff07dd2e"
        },
        "dist": {
            "type": "zip",
            "url": "https://api.github.com/repos/symfony/process/zipball/009f8dda80930e89e8344a4e310b08f9ff07dd2e",
            "reference": "009f8dda80930e89e8344a4e310b08f9ff07dd2e",
            "shasum": ""
        },
        "require": {
            "php": "^5.5.9|>=7.0.8"
        },
        "type": "library",
        "extra": {
            "branch-alias": {
                "dev-master": "3.4-dev"
            }
        },
        "autoload": {
            "psr-4": {
                "Symfony\\Component\\Process\\": ""
            },
            "exclude-from-classmap": [
                "/Tests/"
            ]
        },
        "notification-url": "https://packagist.org/downloads/",
        "license": [
            "MIT"
        ],
        "authors": [
            {
                "name": "Fabien Potencier",
                "email": "fabien@symfony.com"
            },
            {
                "name": "Symfony Community",
                "homepage": "https://symfony.com/contributors"
            }
        ],
        "description": "Symfony Process Component",
        "homepage": "https://symfony.com",
        "time": "2019-01-16T13:27:11+00:00"
    },