Working with nested composer dependencies

Question

I'm working with Roots Bedrock, a WordPress framework that uses a different folder-structure than vanilla WordPress. But this is only a side-note, the actual question is about Composer – not WordPress.

Simplified, my project setup looks like this. The folder dependency is specified in the main composer.json, but installs to themes rather than the default vendor folder.

main
 ├── themes
 │    └── dependency
 │         ├── vendor (2)
 │         └── composer.json (2)
 │ 
 ├── vendor (1)
 └── composer.json (1)

This means, that all the dependencies from composer.json (2) are installed into vendor (1).

How do I handle requiring the autoload.php?

1. In development, I might want to work with dependency independently, so I would require the autoload.php inside vendor (2). The same would be true when working with vanilla WordPress instead of Bedrock.

2. In production, I would normally require dependencies from vendor (1).

Does autoload.php have some kind of "magic" built-in, so that I can always require the nearest autoload.php? Or do I specifically have to require the file from the vendor folder where the actual dependencies are located? I know that package managers for other languages automatically walk up the tree until a match is found (or the root folder was reached).