Kusal provided the correct long-term answer earlier (namely, that you can only allowlist methods from your app’s own classes). If you don’t want to wait a week for the next EAP, or if you simply want to reduce your Velocity dependencies on core Confluence code, you can easily wrap these calls in one of your app’s own methods, and then just allowlist those methods.