diff --git a/man/pandoc-lua.1 b/man/pandoc-lua.1
--- a/man/pandoc-lua.1
+++ b/man/pandoc-lua.1
@@ -1,6 +1,6 @@
-.\" Automatically generated by Pandoc 3.6.3
+.\" Automatically generated by Pandoc 3.6.4
 .\"
-.TH "pandoc-lua" "1" "September 22, 2022" "pandoc 3.6.3" "Pandoc User\[cq]s Guide"
+.TH "pandoc-lua" "1" "September 22, 2022" "pandoc 3.6.4" "Pandoc User\[cq]s Guide"
 .SH SYNOPSIS
 \f[CR]pandoc\-lua\f[R] [\f[I]options\f[R]] [\f[I]script\f[R]
 [\f[I]args\f[R]]]
diff --git a/man/pandoc-server.1 b/man/pandoc-server.1
--- a/man/pandoc-server.1
+++ b/man/pandoc-server.1
@@ -1,6 +1,6 @@
-.\" Automatically generated by Pandoc 3.6.3
+.\" Automatically generated by Pandoc 3.6.4
 .\"
-.TH "pandoc-server" "1" "August 15, 2022" "pandoc 3.6.3" "Pandoc User\[cq]s Guide"
+.TH "pandoc-server" "1" "August 15, 2022" "pandoc 3.6.4" "Pandoc User\[cq]s Guide"
 .SH SYNOPSIS
 \f[CR]pandoc\-server\f[R] [\f[I]options\f[R]]
 .SH DESCRIPTION
diff --git a/man/pandoc.1 b/man/pandoc.1
--- a/man/pandoc.1
+++ b/man/pandoc.1
@@ -1,6 +1,6 @@
-.\" Automatically generated by Pandoc 3.6.3
+.\" Automatically generated by Pandoc 3.6.4
 .\"
-.TH "pandoc" "1" "February 9, 2025" "pandoc 3.6.3" "Pandoc User\[cq]s Guide"
+.TH "pandoc" "1" "March 16, 2025" "pandoc 3.6.4" "Pandoc User\[cq]s Guide"
 .SH NAME
 pandoc - general markup converter
 .SH SYNOPSIS
@@ -1586,11 +1586,10 @@
 For more information, see the section on Citations.
 .RS
 .PP
-Note: if your target format is \f[CR]markdown\f[R], \f[CR]org\f[R], or
-\f[CR]typst\f[R], you will need to disable the \f[CR]citations\f[R]
-extension (e.g., \f[CR]\-t markdown\-citations\f[R]) to see the rendered
-citations and bibliography.
-Otherwise the format\[cq]s own citation syntax will be used.
+Note: if this option is specified, the \f[CR]citations\f[R] extension
+will be disabled automatically in the writer, to ensure that the
+citeproc\-generated citations will be rendered instead of the
+format\[cq]s own citation syntax.
 .RE
 .TP
 \f[CR]\-\-bibliography=\f[R]\f[I]FILE\f[R]
@@ -2763,7 +2762,7 @@
 element, which is preferred to be unitless.
 .TP
 \f[CR]maxwidth\f[R]
-sets the CSS \f[CR]max\-width\f[R] property (default is 32em).
+sets the CSS \f[CR]max\-width\f[R] property (default is 36em).
 .TP
 \f[CR]backgroundcolor\f[R]
 sets the CSS \f[CR]background\-color\f[R] property on the
@@ -3297,6 +3296,9 @@
 filename)
 .SS Variables for Typst
 .TP
+\f[CR]template\f[R]
+Typst template to use.
+.TP
 \f[CR]margin\f[R]
 A dictionary with the fields defined in the Typst documentation:
 \f[CR]x\f[R], \f[CR]y\f[R], \f[CR]top\f[R], \f[CR]bottom\f[R],
@@ -4877,7 +4879,7 @@
 it will be parsed as bibliographic information, not regular text.
 (It will be used, for example, in the title of standalone LaTeX or HTML
 output.)
-The block may contain just a title, a title and an author, or all three
+The block may contain just a title, a date and an author, or all three
 elements.
 If you want to include an author but no title, or a title and a date but
 no author, you need a blank line:
@@ -7180,9 +7182,13 @@
 .EE
 .SH EPUBS
 .SS EPUB Metadata
-EPUB metadata may be specified using the \f[CR]\-\-epub\-metadata\f[R]
-option, but if the source document is Markdown, it is better to use a
-YAML metadata block.
+There are two ways to specify metadata for an EPUB.
+The first is to use the \f[CR]\-\-epub\-metadata\f[R] option, which
+takes as its argument an XML file with Dublin Core elements.
+.PP
+The second way is to use YAML, either in a YAML metadata block in a
+Markdown document, or in a separate YAML file specified with
+\f[CR]\-\-metadata\-file\f[R].
 Here is an example of a YAML metadata block with EPUB metadata:
 .IP
 .EX
@@ -7891,7 +7897,7 @@
 Please audit filters and custom writers very carefully before using
 them.
 .IP "2." 3
-Several input formats (including HTML, Org, and RST) support
+Several input formats (including LaTeX, Org, RST, and Typst) support
 \f[CR]include\f[R] directives that allow the contents of a file to be
 included in the output.
 An untrusted attacker could use these to view the contents of files on
@@ -7907,6 +7913,15 @@
 (Using the \f[CR]\-\-sandbox\f[R] option can protect against this
 threat, but will also prevent including images in these formats.)
 .IP "4." 3
+In reading HTML files, pandoc will attempt to include the contents of
+\f[CR]iframe\f[R] elements by fetching content from the local file or
+URL specified by \f[CR]src\f[R].
+If untrusted HTML is processed on a server, this has the potential to
+reveal anything readable by the process running the server.
+Using the \f[CR]\-f html+raw_html\f[R] will mitigate this threat by
+causing the whole \f[CR]iframe\f[R] to be parsed as a raw HTML block.
+Using \[ga]\[en]sandbox will also protect against the threat.
+.IP "5." 3
 If your application uses pandoc as a Haskell library (rather than
 shelling out to the executable), it is possible to use it in a mode that
 fully isolates pandoc from your file system, by running the pandoc
@@ -7914,7 +7929,7 @@
 See the document Using the pandoc API for more details.
 (This corresponds to the use of the \f[CR]\-\-sandbox\f[R] option on the
 command line.)
-.IP "5." 3
+.IP "6." 3
 Pandoc\[cq]s parsers can exhibit pathological performance on some corner
 cases.
 It is wise to put any pandoc operations under a timeout, to avoid DOS
@@ -7926,7 +7941,7 @@
 \f[CR]commonmark_x\f[R] and \f[CR]gfm\f[R]) is much less vulnerable to
 pathological performance than the \f[CR]markdown\f[R] parser, so it is a
 better choice when processing untrusted input.
-.IP "6." 3
+.IP "7." 3
 The HTML generated by pandoc is not guaranteed to be safe.
 If \f[CR]raw_html\f[R] is enabled for the Markdown input, users can
 inject arbitrary HTML.
diff --git a/pandoc-cli.cabal b/pandoc-cli.cabal
--- a/pandoc-cli.cabal
+++ b/pandoc-cli.cabal
@@ -1,6 +1,6 @@
 cabal-version:   2.4
 name:            pandoc-cli
-version:         3.6.3
+version:         3.6.4
 build-type:      Simple
 license:         GPL-2.0-or-later
 license-file:    COPYING.md
@@ -70,7 +70,7 @@
   buildable:       True
   -- Note: we always link to an exact version of pandoc, with the
   -- same version as this package:
-  build-depends:   pandoc == 3.6.3,
+  build-depends:   pandoc == 3.6.4,
                    text
   other-modules:   PandocCLI.Lua
                  , PandocCLI.Server