This data is not surprising except for the two patch releases
which bear breaking changes (versions 4.0.2–4.0.4 and 3.0.0–3.0.2).
Developers claim that patch releases are free from backwards
incompatible changes but this principle was violated twice. We
tried to identify the nature of the changes introduced and the rationale behind this decision.
Our analysis has found that version 3.0.2 removed web API
methods and changed a data type, whereas version 4.0.4 included
a small change where a field was renamed.
As an attempt to clarify what was the reasoning behind this
decision we reached out to the project’s mailing list. Klaus Espenlaub, one of the VirtualBox developers, claimed that in 4.0.4 a field
was renamed for the sake of clarity and in 3.0.2 there were “more
intrusive” changes but that the removed methods were “not really
useful” and because this functionality had been made available for
a 10-day period (between version 3.0.0 and 3.0.2) they found “the
probability of breaking existing third party code was negligible” and
thus “decided it was worth it”