The source code for ViewVC is maintained in a Subversion repository at Tigris.org. You can checkout the trunk of our development tree from http://viewvc.tigris.org/svn/viewvc/trunk/. You'll need to provide your Tigris.org username and password when so prompted, or, if you don't have a Tigris.org account, use "guest" as the username (with no, or an empty, password).
We've tried to ensure that ViewVC URLs are stable, and that even when we deprecate a particular URL syntax, we continue to support the handling of it (using HTTP redirects to point browsers to the new form of that URL). We know that ViewVC URLs get bookmarked, and nobody likes when their bookmarked URLs suddenly stop working.
Across patch releases of ViewVC (when only the Z component of version X.Y.Z changes), we do our best to keep the configuration file syntax and template data dictionary unchanged, too. This makes it much easier for folks who need to upgrade quickly to get security or other bug fixes. But across major and minor releases, all bets are off, and chances are good that we've done some major plumbing. When upgrading your ViewVC instance across major or minor version numbers, you'll almost certainly want to consult our upgrading HOWTO for tips on how to migrate your configuration files and any template customizations you've made into their new formats.