Hey @simpll! Your App Bridge setup sounds correct. Loading from https://cdn.shopify.com/shopifycloud/app-bridge.js always pulls the latest version, so that requirement is satisfied on the implementation side and nothing needs to change there.
The pending state doesn’t mean the checks ran and failed, or that they’re queued behind a reviewer. It means they haven’t received a signal yet. These checks detect App Bridge activity when the app runs embedded inside the Shopify admin, so if no activity is recorded, both items sit as pending spinners regardless of how correct the code is.
The most common cause is something in the browser or network blocking that telemetry, such as ad blockers, privacy extensions, VPNs, or DNS-level filtering like Pi-hole. Disabling extensions in your usual profile isn’t always enough. A partner on the same shopify-app-react-router stack hit this exact situation and resolved it with a brand-new browser profile in a clean VM, as in this thread. Worth trying that first.
One thing from that thread that’s easy to miss is that an app can work correctly and still not exercise the path the check observes. If you’re only validating the token server-side through authenticate.admin(request), make sure your client-side code is actually calling shopify.idToken() for its requests, and that the shopify-api-key meta tag is in the initial HTML ahead of the App Bridge script rather than injected after it loads. The session token setup guide covers the expected pattern.
If you’ve tried a clean browser and the checks still don’t flip after a couple of hours, follow up here with what you see in the browser Network tab while using the app inside the admin and I can take a closer look - thanks!