We’re pleased to announce the release of Fess 15.8.0.
This release adds a content chunking and embedding pipeline with a semantic branch for regular search and RAG chat, and delivers a large single sign-on hardening pass covering SAML, Microsoft Entra ID, SPNEGO, OpenID Connect, and LDAP — including several permission-resolution fixes that affect which documents a user can see. The search engine baseline moves to OpenSearch 3.8, and Fess plugins are now distributed from maven.codelibs.org.
Highlights
- Content Chunking & Semantic Chunk Search — Crawled document content can now be split into chunks, optionally embedded, and used both for RAG chat context selection and for a semantic branch of regular search. The pipeline ships with a Chunker SPI, an EmbeddingClient SPI that external providers implement as fess-llm-* plugins, a built-in OpenSearch ML Commons provider that adds no new dependencies, and a ChunkVectorJob that runs indexing in a child process. A chunk-only mode lets you chunk documents first and embed them later in place. Everything is disabled by default (content_chunker.enabled=false), so an installation that does not opt in is unaffected.
- Boundary-Aware Chunking — Chunks are cut at sensible text boundaries instead of a fixed character count. Each cut moves to the nearest candidate of the strongest tier available — a sentence end beats a clause separator, which beats a writing-system change — so words and sentences are no longer split in half, which improves both BM25 matching and embedding quality. No character is dropped; only the cut point moves. Non-Latin sentence marks are recognized and orthographic clusters are protected.
- Single Sign-On Hardening — A comprehensive review and hardening pass across every SSO integration: SAML request/response binding and replay rejection, Entra ID token refresh and Microsoft Graph resilience, SPNEGO realm enforcement, OpenID Connect claim handling, and LDAP group resolution. Permission names are now taken from the directory entry, the group’s sAMAccountName, or the asserted user name rather than from a slice of a DN — a name containing a backslash previously collapsed onto another principal’s permission, so a user could match documents belonging to a different group. Credentials, tokens, and private keys are kept out of logs and diagnostic screens, and refused handshakes are reported as messages rather than stack traces.
- Access Control Fixes — Admin API access is decided on the access token itself rather than on a request parameter (a search token configured with a parameter name could otherwise reach the whole administration API), unauthorized admin API requests are answered with 401, login.required is honored on the /api/v2 surface, and a logged-in user who resolved no permission is filtered by the guest roles instead of running unfiltered.
- OpenSearch 3.8 Support — Fess is now built against OpenSearch 3.8.0, with the bundled analysis, configsync, minhash, and k-NN plugins updated to match.
Configuration Keys Renamed (api.v2.* → api.*)
The API version belongs in the endpoint path, not in a settings key. An override still written under an old key is no longer read, and the documented default applies instead — if you override any of these, rename them before upgrading. The /api/v2 endpoint paths themselves are unchanged.
api.v2.param.max.length → api.param.max.length
api.v2.param.max.array.size → api.param.max.array.size
api.v2.click.max.rt → api.click.max.timestamp
api.v2.chat.stream.keepalive.interval.ms → api.chat.stream.keepalive.interval.ms
api.v2.chat.rate.limit.per.user.per.minute → api.chat.rate.limit.per.user.per.minute
Plugin Distribution Moved to maven.codelibs.org
Fess plugins are now released to the CodeLibs repository instead of Maven Central, and the Admin plugin installer looks there first. Maven Central is still consulted for plugins released before the migration, so existing plugin installations continue to work.
Release Notes: Release Fess 15.8.0 · codelibs/fess · GitHub
Docker Image: Package fess · GitHub
Documentation: https://fess.codelibs.org/
Community Forum: https://discuss.codelibs.org/
We recommend upgrading to Fess 15.8.0 for the SSO and permission-resolution fixes, the new content chunking and semantic search pipeline, and OpenSearch 3.8 support.
Thank you for using Fess!