This dependency is probably a remnant from times when mail module was part of main.
I'd suggest to move the dependency to the mail module only.

As a side note, velocity 1.5 brings commons-lang-2.1 to the bundle (use to be commons-lang-2.4 which was brought by the main dependency management but the dependency was removed in favour of commons-lang3). The newest version 1.7 has dependency to commons-lang-2.4 so we could increase the version.