Cap v4 patch

package.json

@@ -21,9 +21,10 @@
     "format": "prettier --write --ignore-unknown .",
     "format:check": "prettier --check .",
     "test": "npm run format:check && npm run lint && npm run flow && npm run test:unit",
+    "test:unit": "vitest run --coverage",
+    "test:watch": "vitest",
     "webpack": "babel-node --plugins=transform-es2015-modules-commonjs ./node_modules/.bin/webpack -- --progress",
     "test:unit:watch": "vitest --coverage",
-    "test:unit": "vitest run --coverage",
     "prepublishOnly": "npm run babel",
     "postpublish": "rm -rf ./server && git checkout ./server",
     "validate-codecov": "curl --data-binary @.github/codecov.yml https://codecov.io/validate",

server/meta.jsx

@@ -5,7 +5,6 @@
 import urlLib from "url";
 
 import {
-  ENV,
   SDK_PATH,
   SDK_QUERY_KEYS,
   SDK_SETTINGS,
@@ -167,8 +166,8 @@ function isLocalUrl(host: string): boolean {
     HOST.LOCALTUNNEL,
   ];
 
-  // eslint-disable-next-line no-process-env
   return (
+    // eslint-disable-next-line no-process-env
     process.env.NODE_ENV === "development" &&
     localUrls.some((url) => host.includes(url))
   );
@@ -177,7 +176,7 @@ function isLocalUrl(host: string): boolean {
 function validateHostAndPath(
   hostname: string | null,
   pathname: string | null
-): { hostname: string, pathname: string } {
+): {| hostname: string, pathname: string |} {
   if (!pathname || !hostname) {
     throw new Error(`Expected host and pathname to be passed for sdk url`);
   }
@@ -206,6 +205,7 @@ function validateSDKUrl(sdkUrl: string) {
     );
   }
 
+  // eslint-disable-next-line no-useless-escape
   const hostnameMatchResults = hostname.match(/[a-z0-9\.\-]+/);
 
   if (!hostnameMatchResults || hostnameMatchResults[0] !== hostname) {
@@ -360,6 +360,27 @@ export function unpackSDKMeta(sdkMeta?: string): SDKMeta {
                                 version = '';
                             }
 
+                            // if patch version is less than 132, we want to 
+                            // set the version to 132. If for some reason we can't
+                            // parse out a patch version, set version as latest
+                            // if neither cases are true, leave version alone because
+                            // it can be more than a semver version number ("min" for example)
+                            //
+                            // NOTE ABOUT REGEX
+                            // The . in the regex technically need to be escaped but that breaks the 
+                            // regex in real browsers. Because we are writing JavaScript in a string, we
+                            // need a double escape (\\.) which breaks the browser but works when using eval()
+                            // a single escape works in the browser but breaks in the tests with eval()
+                            if (/4.0.\\d{1,3}/.test(version)) {
+                              var patchString = version?.split('.')?.pop()
+
+                              if (!patchString) {
+                                version = ''
+                              } else if (parseInt(patchString, 10) < 132) {
+                                version = '4.0.132' 
+                              }
+                            }
+
                             var url = '${baseURL}checkout' + (version ? ('.' + version) : '') + '.js';
                             var attributes = '${DATA_ATTRIBUTES.PAYPAL_CHECKOUT} ${DATA_ATTRIBUTES.NO_BRIDGE}';