Load datasources in iFrames
All datasources should be loaded in sandboxed iFrames and communicate via post messages with the core. This leads to no less XSS risk in hosted versions of the dashboard that might load un-trusted plugins. Also it solves the problem of dependency management. Each datasource can have it's own version of dependencies without polluting the global namespace.
Up to discussion: Should each datasource instance get it's own iFrame or each datasource plugin? I prefer the first one, but the second might improve overall performance. I prefer to optimize later in case the performance matters.