There's a couple of places in JIRA where we leak (or could potentially leak) the VelocityEngine directly or indirectly via the WW-ActionContext threadlocal.
- WebWorkAdaptor.mapJellyTagToAction (finalizeContext should be in finally block)
- JiraPluginWebworkVelocityServlet (static declaration of VelocityManager)
- SearchContextImpl.GLOBAL_SEARCH_CONTEXT may hold on to VelocityManagers (via several links)
- QuickLinkServlet: locally caches several managers that may hold on to the VelocityManager/Engine.