Update package dependencies and enhance CSV handling in CMS

This commit updates the version of several packages in package.json and package-lock.json, including downgrading "quill" to 2.0.2 and upgrading "devalue", "diff", "h3", "node-mock-http", "tar", and "undici" to their latest versions. Additionally, it improves the CSV file handling in the CMS by implementing a cache-busting mechanism for fetching data and enhancing error handling during file saving, ensuring more robust data management.

server/api/cms/save-csv.post.js

@@ -45,33 +45,49 @@ export default defineEventHandler(async (event) => {
       })
     }
     
-    // Handle both dev and production paths
+    // Wichtig: In Production werden statische Dateien aus `.output/public` ausgeliefert.
+    // Wenn PM2 `cwd` auf das Repo-Root setzt, ist `process.cwd()` NICHT `.output` –
+    // daher schreiben wir robust in alle sinnvollen Zielorte:
+    // - `.output/public/data/<file>` (damit die laufende Instanz sofort die neuen Daten liefert)
+    // - `public/data/<file>` (damit der nächste Build die Daten wieder übernimmt)
+    //
     // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
     // filename is validated against allowlist above, path traversal prevented
     const cwd = process.cwd()
-    let filePath
-    
-    // In production (.output/server), working dir is .output
-    if (cwd.endsWith('.output')) {
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
-      filePath = path.join(cwd, '../public/data', filename)
-    } else {
-      // In development, working dir is project root
-      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
-      filePath = path.join(cwd, 'public/data', filename)
+    const candidatePaths = [
+      path.join(cwd, '.output/public/data', filename),
+      path.join(cwd, 'public/data', filename),
+      path.join(cwd, '../public/data', filename), // falls cwd z.B. `.output` oder `.output/server` ist
+      path.join(cwd, '../.output/public/data', filename)
+    ]
+
+    const uniquePaths = [...new Set(candidatePaths)]
+    const writeResults = []
+    const writeErrors = []
+
+    for (const targetPath of uniquePaths) {
+      try {
+        const dataDir = path.dirname(targetPath)
+        await fs.mkdir(dataDir, { recursive: true })
+        await fs.writeFile(targetPath, content, 'utf8')
+        writeResults.push(targetPath)
+      } catch (e) {
+        writeErrors.push({ targetPath, error: e })
+      }
+    }
+
+    if (writeResults.length === 0) {
+      console.error('Konnte CSV-Datei in keinen Zielpfad schreiben:', writeErrors)
+      throw createError({
+        statusCode: 500,
+        statusMessage: 'Fehler beim Speichern der Datei'
+      })
     }
-    
-    const dataDir = path.dirname(filePath)
-    
-    // Sicherstellen, dass das Verzeichnis existiert
-    await fs.mkdir(dataDir, { recursive: true })
-    
-    // Datei schreiben
-    await fs.writeFile(filePath, content, 'utf8')
     
     return {
       success: true,
-      message: 'Datei erfolgreich gespeichert'
+      message: 'Datei erfolgreich gespeichert',
+      writtenTo: writeResults
     }
     
   } catch (error) {