Bump smarty/smarty from 4.5.6 to 4.5.7

[dependabot]

Bumps smarty/smarty from 4.5.6 to 4.5.7.

Release notes

Sourced from smarty/smarty's releases.

v4.5.7

What's Changed

• Port security fixes from v5.8.2 to Smarty v4. by @​wisskid in smarty-php/smarty#1194

Full Changelog: smarty-php/smarty@v4.5.6...v4.5.7

Changelog

Sourced from smarty/smarty's changelog.

[4.5.7] - 2026-06-29

• Security: prevent symlinks inside a trusted secure_dir/template directory from being used to read files outside of it (CWE-22 path traversal), affecting {include} and {fetch} of local files
• Security: {html_image} now escapes the file, path_prefix, href/link, width and height attributes (it already escaped alt and pass-through attributes), and {html_select_date} casts day_size/month_size/year_size to int (matching {html_select_time}), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
• Security: {fetch} no longer follows HTTP redirects for remote resources while a security policy is active, preventing an open redirect on a trusted host from bypassing trusted_uri (CWE-918 server-side request forgery)

Commits

• 838d6ad Merge branch 'release/4.5.7' into support/4
• 187f7b6 version bump
• a1ccdb0 Port security fixes from v5.8.2 to Smarty v4. (#1194)
• c285f84 Reproduce block override leakage in template inheritance
• See full diff in compare view

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[driusan]

@dependabot rebase