SiteMapItemHandler using HstRequestContext#getSession() could lead to jcr session leak.

In summary:
HstRequest.getSession() calls in a SiteMapItemHandler implementation may lead to JCR sessions leak (not returning used sessions to the session pool automatically).

So, the solution for now is that each SiteMapItemHandler using HstRequestContext.getSession() must return the used JCR session manually by itself.

I think this will fix the problem for now.

But we will probably consider improving this more naturally in the future.
I don't have any concrete ideas, but I remember Ard has once mentioned you can introduce a separate valve-pipeline to which most logic of HstFilter should be moved.
In that case, maybe the sitemapitemhandler processing logic can be inside a valve. Then the used session in sitemapitemhandlers can be cleaned up in the cleanupvalve, too.