---
package: inversify
version: "^6.2.0"
tier: feature
decision: approved
date: 2026-05-14
deciders: [Danijel Martinek]
adr: adr-002
lastRevalidated: null
is-sub-processor: false
processes-pii: false
filter-results:
  license: MIT
  types: native
  maintenance: active
  boundary-fit: pass
  shadow-check: pass
  eu-residency: n/a
  cve-scan: clean
  named-consumer: pass
  socketRisk: clean
verification-commands:
  - npm view inversify license
  - npm view inversify version
  - pnpm audit --audit-level=moderate
accepted-cves: []
---

## Filter: license

<!-- Result: MIT -->

`npm view inversify license` returns `MIT`. MIT is on the allowlist.

## Filter: types

<!-- Result: native -->

inversify is authored in TypeScript and ships its own `.d.ts` declaration files. No separate `@types/inversify` package is needed.

## Filter: maintenance

<!-- Result: active -->

Actively maintained; the 6.x line has seen recent releases addressing TypeScript compatibility improvements. Last release < 18 months, issue tracker shows ongoing engagement.

## Filter: boundary-fit

<!-- Result: pass -->

ADR-002 explicitly mandates InversifyJS as the DI framework for all feature packages. The ESLint boundary rules (ADR-010) do not restrict inversify to any specific path — feature packages are the declared consumers.

## Filter: shadow-check

<!-- Result: pass -->

inversify is the workspace-locked DI container per ADR-002. No parallel DI framework (tsyringe, awilix, etc.) is present or proposed.

## Filter: eu-residency

<!-- Result: n/a -->

inversify is a pure runtime library with no network communication, telemetry, or data transmission. EU residency does not apply.

## Filter: cve-scan

<!-- Result: clean -->

`pnpm audit --audit-level=moderate` reports no advisories against inversify at the time of this trace.

## Filter: named-consumer

<!-- Result: pass -->

All five feature packages — `@repo/auth`, `@repo/blog`, `@repo/media`, `@repo/marketing-pages`, `@repo/navigation` — depend on inversify for their per-feature DI containers (ADR-008). Concrete named consumers exist today.

## Prompt: replaces

Manual composition root patterns considered during initial architecture setup. InversifyJS replaces ad-hoc factory chaining that would not scale beyond three or four services per feature. No parallel approach is running.

## Prompt: migration-cost-out

Hard. InversifyJS container bindings, symbols, and decorator usage are scattered across every feature package's `di/` layer. Migrating out would require replacing all `@injectable()` / `@inject()` decorators, SYMBOLS definitions, and container bind calls across five feature packages simultaneously. The interface boundaries (ADR-002) reduce the surface, but the volume of changes is substantial. The per-feature container pattern (ADR-008) limits blast radius to one package at a time.

## Prompt: alternatives-considered

1. **tsyringe** (Microsoft) — lighter API but fewer lifecycle options and weaker TypeScript inference at the time of evaluation.
2. **Manual composition root** — zero dependency but does not scale past ~5 services without significant boilerplate and loses automatic dependency chain resolution.

See ADR-002 for the full decision rationale.