update smarty and add require-dev to lock