This is primarily a security release in response to the token_values potential Cross Site Scripting issue. Pathauto on its own is not affected, but token values provided by Pathauto were not properly checked and may have caused a problem if used by another module (no known examples exist).