When several things ship from one repository, they do not all move at once. A release is a set of versions, and the set has to be consistent: a library and an application built from different commits of the same branch is a release that was never tested together.
About 1 min of reading
Pin one commit.
The snapshot
Before you run it, say out loud what it will print. Then open the answer.
A release branch cut from main is the snapshot everything is built from. Building from main while main moves is the bug that makes two artifacts in one release disagree.
A test that runs the application against its stated library version, run as part of the release. That test is the only thing that makes the pair a fact rather than a note.
Every artifact in a release comes from the same commit. That is the property that makes the release describable by one hash, and it is what a build farm has to enforce.
A component that did not change keeps its old version. Bumping everything on every release produces numbers that carry no information, and consumers compare them.
State which library version each application version was tested against. That pair is the contract; an unstated pair is a claim that nothing was verified.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.