Depending on the framework that use for your DB-to-GraphQL layer (like Hasura / join monster/ PostGraphile / subZero etc) there can be some there can be some limitations on what it can and cannot do, but that is not really a GraphQL problem.

The GraphQL specific gotchas for me where

- For most part component level queries works well, occasionally batching in higher component is important for performance, for example instead of executing a secondary query on each row of the table ( say fetching photos of user profiles from a different store) doing it one level up can speed things up.

- Caching has to be solved very differently than RESTful APIs, GraphQL has everything in one endpoint as POST and you cannot leverage CDN's to cache the canonical resource URLs

- Less verbosity or nested request-responses could be important for UX performance, using HATEOS style discoverability usually results in many APIs calls 2-3 levels or more deep, in RESTful systems that is not a major problem as you are caching API responses in nodes in dozen locations/CDN PoPs near the user but that is not possible in GraphQL, so you have to keep mind of verbosity, that can also impact how you store and index your database and how you configure and run replicas etc at scale.

---

Anecdotally I have used Hasura as GraphQL frontend for an existing mature PostgreSQL db and APIs, (1 tb+, 1000's of concurrent users), and it scales fairly well even with 4-5 level nested joins or fetch ten of thousands of nested records. Hasura also does subscriptions reasonably well and they don't use triggers for implementing it.

Some areas that needed a bit work around for me - recursive CTEs, cross-db joins, performance of very large counts ( postgres problem - using HLL or tuples from the planner if approximate values are fine.

You can also join additional data to reference in deeper resolvers, but that's an antipattern AFAIK.

Lack of updates also isn't necessarily an indicator of disuse. It currently has close to 5 million weekly downlaods, roughly 1/5th of express which is probably the most popular library for building APIs in node.

    query {
        myCustomQuery(...params...) {
            id
            whatever
        }
    }

    async function resolver(ctx) {
         const rows = await db.query(sql`SELECT yadda as id, badda as whatever FROM dabba JOIN dada ON ...`);
         return rows;
    }

You could validate against having too many layers of nesting in one query, validate pagination, provide abstract relationships for the many nesting and special case those joins, etc.

It's basically a question of how to efficiently query data. There's always ways, but it might require some trimming of allowed graphql queries.

The GraphQL Server in RedwoodJS does query depth limiting out-of-the-box. You can configure it, but by default the depth is 11 -- because all the best things go to 11.

[1] https://redwoodjs.com/docs/graphql#query-depth-limit