`npm install primevue` now needs a licence key: what changed, and how to stay on MIT

I build client projects on Nuxt, PrimeVue and Tailwind, and a fresh npm install primevue no longer gives you what most tutorials assume. It installs version 5, which left the MIT licence. Without a licence key, a red "Invalid PrimeUI License" badge sits at the bottom right of every page.

To be clear from the start: this is PrimeTek's decision to make, and the library is worth paying for if you need it. PrimeUI has a free Community tier and paid licences, so if you qualify or you have a key, v5 is the normal choice. This post is for people who want to stay on MIT versions, and want to be sure they have.

What changed

That's the situation on 2026-11-07. Check PrimeTek's current terms for what applies to you.

Why it's easy to miss

• Nothing fails. The install works and the build passes. The badge only appears once the page runs in a browser.
• It's more than one package. primeicons and @primeuix/themes moved too, on different version numbers, so fixing primevue alone isn't enough.
• You can't grep for it. The badge lives in a closed shadow root, so a text search of the HTML can miss it. It's easier to read the license field of what you actually installed.
• npm install primevue@4.5.5 isn't a pin. npm saves it as ^4.5.5. That range won't jump to 5, but if you want the version fixed, add --save-exact.

Two commands

For a new project:

npm create nuxt-primevue@latest 

It asks for a theme, a primary colour, a font and whether you want the demo page. You get Nuxt 4, PrimeVue 4.5.5 and Tailwind 4 with the CSS layers in the right order, so utilities beat PrimeVue's styles. Dark mode and self-hosted fonts are already wired up. The demo page reads the real installed versions and licences, so what it shows is the truth about your project.

For an existing project:

npx create-nuxt-primevue doctor 

It reads your node_modules, lists every Prime package that isn't MIT, and asks whether you have a licence key. If you do, it stops there. If you don't, it shows the exact changes and asks first; the default answer is No. It needs a clean git tree, so you can always undo. After a fix it runs your install, your build and the licence check, and tells you what happened. It never commits for you.

Use doctor --check in CI: exit code 1 means a problem remains.

The guard

A pin stops you drifting. It doesn't stop someone running npm i primevue@latest six months from now. So generated projects run a small check as part of the build, and doctor offers to add it to yours:

"build": "node scripts/check-licences.mjs && nuxt build" 

Only the exact licence MIT passes. A missing field fails. And it fails closed: if package.json lists a Prime package that isn't installed, the build stops, rather than passing because it found nothing to check.

What surprised me while building it

prebuild doesn't run on Yarn Berry. My first version used a prebuild script. Yarn 2 and later don't run pre hooks, so the guard silently never ran. That's why it now sits inside the build script.

npm drops .gitignore from published packages. A template that relies on one ships without it, and the first commit includes node_modules. The CLI now writes that file itself.

pnpm stops on build scripts nobody approved. A fresh project failed to install because of esbuild's install script. The CLI now writes a pnpm-workspace.yaml that answers that question up front.

Proving something is absent is hard. "No badge found" means nothing if the page didn't render. So the test also runs on a project with v5 deliberately installed, where it must find the badge, and it clicks a real button to prove the page is alive. Without that positive control, a broken test would look exactly like a healthy project.

Windows short paths can break a build. On GitHub's Windows runner, a project built from C:\Users\RUNNER~1\... returned HTTP 500 on every page, with an import that didn't exist. The same project built from the long path worked. I haven't traced which build step writes the bad import, so it's in the guide as a proven trigger rather than an explanation.

How it's tested

I only write tests for the behaviour that really matters here, and I check those tests with mutation testing: Stryker changes the code in small ways, and a test suite that doesn't notice fails CI. The floor is 100% on the critical modules. CI also builds real projects with npm, pnpm, Yarn and bun on Linux, and npm on Windows.

What it doesn't do

It doesn't remove or hide the badge, and it won't help you use v5 without a licence. It keeps you on versions that are still MIT and tells you if you leave them. Staying on v4 also has a cost: no new v4 features, and nothing that exists only in v5. If you'd rather have a library that keeps getting updates under MIT, OpenVue is a community-maintained fork of PrimeVue 4.5.5. My tool isn't connected to it, and I haven't tested it.

The code is at kiri1101/create-nuxt-primevue (MIT), and the guide covers the licence change plus thirteen other problems in this stack, most of which fail without an error. If doctor gets something wrong on your project, please open an issue: real projects are the test I can't run myself.