`.
+ Removed.
+- **JS-escape login locale strings** (PR #183): `LOGIN_INVALID_PW` and
+ `LOGIN_CONN_FAILED` were injected into a JS string context without escaping
+ single quotes or backslashes. Now uses minimal JS-string escaping.
+
+---
+
## [v0.39.1] — 2026-04-08
### Bug Fixes
diff --git a/static/index.html b/static/index.html
index 9452d0f..a01fa20 100644
--- a/static/index.html
+++ b/static/index.html
@@ -14,7 +14,7 @@