Release Incident Playbook

Email or SMS provider template broken: symptoms, cause, and the test that catches it

Transactional messages are sent with broken templates or to wrong recipients after a template change.

Email or SMS provider template broken is documented by 2 accepted public reports from 2 organisations, 1 of them published in the last 5 years.

  • Likelihood: not published (1 public report in 5 years)
  • Impact: medium (1 of 2 reports: availability)

2 public reports · verified 2026-10-22

Symptoms

User-visible

  • Password reset emails went out with the lostPasswordUrl template variable not replaced by the actual value.[1]
  • Users reported on the publishing project's forum that password reset was not working as expected.[1]
  • Signing invitation emails arrived without text or invite link and showed only unfilled variables.[2]
  • Signing transactions could not be created, or stayed in progress and could not be finalized.[2]

Monitoring-visible

  • With the mailer set to log, the mail log showed the password reset template variable left unreplaced.[1]
  • Errors appeared in the email log around 16:33 CET, after the email script release.[2]

Root causes

  1. stage: code A change replaced passwordResetUrl with lostPasswordUrl in the PASSWORD_RESET_CONFIRM template to keep the reset hash out of review reminder logs, but no lostPasswordUrl variable exists.[1]
  2. stage: migration The PASSWORD_RESET_CONFIRM change was not in the migration script, so the broken template reached fresh installs.[1]
  3. stage: code A regular script version update to the email functionality caused signing invitation emails to be sent without content.[2]
  4. stage: release-process The first rollback of the email script update did not restore the expected behaviour, and only a second rollback brought back the version with correct mail templates.[2]

Public examples

  1. [1]Public Knowledge Project, 2023-06-26. In OJS 3.4 the PASSWORD_RESET_CONFIRM email template had passwordResetUrl replaced by lostPasswordUrl, a variable that does not exist, so the password reset email went out with the variable not substituted; maintainers renamed the variable and fixed localized bodies for milestone 3.4.0-2. primary Wrong variable name in PASSWORD_RESET_CONFIRM email template
  2. [2]Signhost Verified Signing, 2021-06-14. After Signhost released a script version update in its email functionality, signing invitation emails were sent for about an hour without text or invite link and contained only unfilled variables, until a second rollback restored the previous version with correct mail templates. primary Sign invite mails do not contain invite link

Test classes that catch it

Test classStageLimitationBasis
Integration testspre-deployAn integration test run on an install upgraded from an earlier release misses the lostPasswordUrl regression, which reached fresh installs because the change was not in the migration script.cited in [2]
Unit testspre-mergeA unit test that renders PASSWORD_RESET_CONFIRM against its variable list catches lostPasswordUrl, but it does not run the deployed email script version that sent the empty signing invitations.by design analysis
End-to-end testspre-deployAn end-to-end password reset test that stops at the confirmation screen passes, because the unreplaced variable sat in the email body the user received.by design analysis

Risk

  • Likelihood: not published (1 public report in 5 years)
  • Impact: medium (1 of 2 reports: availability)
Counts behind the grades
Accepted public reports2
Published in the last 5 years1
Impact stated: degraded1
Impact stated: availability1

How the grades are computed

Pre-release checklist

  • PR-01
  • PR-02
  • PR-03
  • PR-04
  • PR-05
  • PR-06
  • PR-07
  • PR-08

First 30 minutes

  • FM-01
  • FM-02
  • FM-03
  • FM-04
  • FM-05
  • FM-06
  • FM-07

Download the checklist

What catches this: catalogue entries

Listed because their own documentation or site names integration tests, unit tests, end-to-end tests on the verification date. Alphabetical. Not a recommendation.

Tools whose documentation names these test classes

Providers whose site names these test classes

Only on this page

In report [2], the email script update had passed automatic tests and manual staging tests before release [2]. Signing invitation emails still went out for about an hour without text or invite link [2]. The first rollback did not restore the expected behaviour [2]. A second rollback restored the previous version with correct mail templates [2]. The report names more thorough integration testing of releases and an updated rollback protocol as follow-ups [2].

In report [1], the broken PASSWORD_RESET_CONFIRM variable reached fresh installs because the template change was not in the migration script [1]. The reproduction steps used a fresh install with the mailer logging to file [1]. An integration test for email or SMS provider template broken therefore needs a fresh install and an upgraded install, each rendering the message a user receives.

Questions

What causes email or SMS provider template broken?

In report [1], a template change referenced a lostPasswordUrl variable that does not exist. In report [2], a script version update to the email functionality sent signing invitations without content.

What are the symptoms of email or SMS provider template broken?

Password reset emails arrived with an unreplaced template variable [1]. Signing invitation emails arrived without text or invite link and showed only unfilled variables [2].

Why did tests not catch email or SMS provider template broken?

The email script update in report [2] had passed automatic tests and manual staging tests. The template regression in report [1] reached fresh installs only, because it was not in the migration script.

Which test class catches email or SMS provider template broken, and what does it miss?

Integration tests carry the cited label, because report [2] names more thorough integration testing of releases. Unit and end-to-end tests carry the by-design label. An integration test on an upgraded install misses the fresh-install regression in report [1].

Which public reports document email or SMS provider template broken?

Two primary reports from two organisations document it. They were published on 2021-06-14 [2] and 2023-06-26 [1].

Should a team roll back or fix forward when email or SMS provider template broken happens?

Report [2] rolled back twice, because the first rollback did not restore the expected behaviour. FM-04 and FM-05 send a test message after each rollback to confirm the content is correct.

Release Incident Playbook (2026). Email or SMS provider template broken: symptoms, cause, and the test that catches it, content version 1.0.0. https://releasefailures.com/incidents/email-or-sms-provider-template-broken/. Accessed 2026-10-21.