Yes, yes and yes. The toolchain and the dependencies should be pinned. Otherwise sooner or later you'll hit the customer's issue that you won't be able to repr

Yes, yes and yes. The toolchain and the dependencies should be pinned. Otherwise sooner or later you'll hit the customer's issue that you won't be able to reproduce - until you realize it's some subtle bug in the specific version of your compiler.