If my understanding is good, with apt update, Debian download a release file and with this file, it can tell if a package needs to be upgraded and with which dependencies. How does it do this? Th release file seems to be just a list of hashes so I don't quite understand.
Sorry, I don't have a very good English.
Whilst apt update can download one or more Release files, the primary files it is downloading are Packages file(s). Those files contain the full list of available packages, their versions, and other metadata (like dependencies). Once apt has a list of available packages and their versions, it is a straightforward matter of comparison to determine which packages have versions newer than those currently installed.
Package lists are the Packages and Sources files. These contain the debian/control file content for every package in the repository. From these metadata APT can determine a dependency solution.
Releases is a description of the entire archive and signature data.
Debian reference manual, Chapter 2. Debian package management
