There's a couple of places in JIRA where we leak (or could potentially leak) the VelocityEngine directly or indirectly via the WW-ActionContext threadlocal.

These are:

• WebWorkAdaptor.mapJellyTagToAction (finalizeContext should be in finally block)
• JiraPluginWebworkVelocityServlet (static declaration of VelocityManager)
• SearchContextImpl.GLOBAL_SEARCH_CONTEXT may hold on to VelocityManagers (via several links)
• QuickLinkServlet: locally caches several managers that may hold on to the VelocityManager/Engine.