Yes, yes and yes. The toolchain and the dependencies should be pinned.

Otherwise sooner or later you'll hit the customer's issue that you won't be able to reproduce - until you realize it's some subtle bug in the specific version of your compiler.