In order to prevent HTML injection from translation values it's recommended to use ``escapeHTML``

    someElement.update('$escapetool.javascript($services.localization.render("key"))'.escapeHTML());

Also, as you can see I used quotes and not apostrophes inside in order to make the JavaScript valid for a parser that doesn't evaluate the Velocity code (as it happens when the JSX is minified).