wasi-nn: update OpenVINO to v2025.1 (#11054)

* wasi-nn: update OpenVINO to v2025.1

This updates the version of the bindings used for communicating with
OpenVINO to v0.9.0 as well as the GitHub action used to install the
latest version of OpenVINO (v2025.1.0) in CI.

* deny: remove skipped `wit-bindgen`

This avoids an `unmatched-skip-root` warning emitted by `cargo-deny`:
"skip tree root was not found in the dependency graph."

* deny: ignore `file-per-thread-logger`

This crate has not been updated in a while and thus imports some older
dependencies, causing duplicates that `cargo-deny` flags.

* vet: certify update of `openvino-*` crates

prtest:full

Author: abrown

.github/workflows/main.yml

@@ -794,7 +794,7 @@ jobs:
     - uses: ./.github/actions/install-rust
 
     # Install OpenVINO
-    - uses: abrown/install-openvino-action@v9
+    - uses: abrown/install-openvino-action@v10
       if: runner.arch == 'X64'
 
     # Install WinML for testing wasi-nn WinML backend. WinML is only available

Cargo.lock

@@ -38,7 +38,7 @@ ort = { version = "2.0.0-rc.2", default-features = false, features = [
 tch = { version = "0.17.0", default-features = false, optional = true}
 
 [target.'cfg(target_pointer_width = "64")'.dependencies]
-openvino = { version = "0.8.0", features = [
+openvino = { version = "0.9.0", features = [
     "runtime-linking",
 ], optional = true }
 

crates/wasi-nn/Cargo.toml

@@ -37,13 +37,6 @@ wildcards = "allow"
 deny = []
 
 skip-tree = [
-    # wit-bindgen and wasmtime both depend on the wasm-tools crates, and
-    # wit-bindgen's latest release may sometimes lag behind when we bump
-    # wasmtime's dependencies on wasm-tools. wit-bindgen is only used for
-    # building component-based test programs, so we are going to ignore
-    # the multiple-versions errors it will introduce.
-    { name = "wit-bindgen", depth = 20 },
-
     # proptest depends on bitflags 1.x.x while other crates depend on 2.x.x so
     # ignore its dependency tree until it updates.
     { name = "proptest", depth = 20 },
@@ -52,10 +45,6 @@ skip-tree = [
     # dependencies relative to Wasmtime's main dependency tree.
     { name = "witx", depth = 20 },
 
-    # The openvino-sys crate uses an older version of `pretty_env_logger` so
-    # ignore its dependency tree for now until it updates.
-    { name = "openvino-sys", depth = 20 },
-
     # They want to publish version 2.0 to upgrade `hashbrown` so in the meantime
     # it is duplicated for us.
     { name = "indexmap", depth = 2 },
@@ -65,4 +54,6 @@ skip-tree = [
 
     # right now terminal_size pulls in an older version of io-lifetimes
     { name = "io-lifetimes" },
+
+    { name = "file-per-thread-logger", reason = "this uses an old version of env-logger; may be unmaintained?" }
 ]

deny.toml

@@ -2695,6 +2695,11 @@ criteria = "safe-to-deploy"
 delta = "0.7.2 -> 0.8.0"
 notes = "No new unsafe functionality, just brings in openvino-sys changes and other minor improvements."
 
+[[audits.openvino]]
+who = "Andrew Brown <andrew.brown@intel.com>"
+criteria = "safe-to-deploy"
+delta = "0.8.0 -> 0.9.0"
+
 [[audits.openvino-finder]]
 who = "Matthew Tamayo-Rios <matthew@geekbeast.com>"
 criteria = "safe-to-deploy"
@@ -2724,6 +2729,11 @@ criteria = "safe-to-deploy"
 delta = "0.7.2 -> 0.8.0"
 notes = "No logic changes in version bump."
 
+[[audits.openvino-finder]]
+who = "Andrew Brown <andrew.brown@intel.com>"
+criteria = "safe-to-deploy"
+delta = "0.8.0 -> 0.9.0"
+
 [[audits.openvino-sys]]
 who = "Matthew Tamayo-Rios <matthew@geekbeast.com>"
 criteria = "safe-to-deploy"
@@ -2753,6 +2763,11 @@ criteria = "safe-to-deploy"
 delta = "0.7.2 -> 0.8.0"
 notes = "This diff simply re-generates slightly newer C headers with a slightly newer version of bindgen."
 
+[[audits.openvino-sys]]
+who = "Andrew Brown <andrew.brown@intel.com>"
+criteria = "safe-to-deploy"
+delta = "0.8.0 -> 0.9.0"
+
 [[audits.ort]]
 who = "Andrew Brown <andrew.brown@intel.com>"
 criteria = "safe-to-deploy"