Build fails if composer.lock is missing in repo

[ymarkus]

So, I've been trying to package https://github.com/bolt/core, but building it throws this error:

error: builder for '/nix/store/qhj7vqxr4gv0d3ysgzwgqcspwsdxg248-bolt.drv' failed with exit code 4;
       last 10 log lines:
       > - Required package "twig/intl-extra" is not present in the lock file.
       > - Required package "twig/twig" is not present in the lock file.
       > - Required package "ua-parser/uap-php" is not present in the lock file.
       > - Required package "webimpress/safe-writer" is not present in the lock file.
       > - Required package "webmozart/path-util" is not present in the lock file.
       > - Required package "webonyx/graphql-php" is not present in the lock file.
       > - Required package "xemlock/htmlpurifier-html5" is not present in the lock file.
       > This usually happens when composer files are incorrectly merged or the composer.json file is manually edited.
       > Read more about correctly resolving merge conflicts https://getcomposer.org/doc/articles/resolving-merge-conflicts.md
       > and prefer using the "require" command over editing the composer.json file directly https://getcomposer.org/doc/03-cli.md#require-r

The repository itself sadly has no composer.lock file, but I can't find a way to patch it in... I've tried installPhase, patches and so on.