In messages.en.yml, I have
confirmed: Congrats %username%, your account is now activated.
But I want to \'bold\' username to
My approach is although still ugly, but at least respects the separation of concerns. Escape filter is used to escape a variable, making the final result is pretty safe from XSS, because all other sources considered to be hard-coded.
translations.yml
points: You have %num% points left.
template.html.twig
{% set pointsFormatted = '' ~ num | escape ~ '' %}
{{ 'pages.score.points' | trans({'%num%' : pointsFormatted}) | raw }}