State of GraphQL 2022 Preliminary Discussion

[SachaG]

I'm exploring the idea of doing a "State of GraphQL" survey, so I'm opening this thread to gather feedback.

• If you use GraphQL, which questions would you hope the survey would answer?
• Which areas should it cover?
• Which features/architecture patterns/libraries/services should be included?
• What other questions can we ask to get a better picture of the GraphQL community?
• What are the main current GraphQL pain points we should ask about?
• What are the main currently missing features we should ask about?

Let me know here!

[nikolasburk]

Cool idea! I'd love to get an understanding for what schema builder libraries (SDL-first vs various code-first approaches like TypeGraphQL, Pothos, Nexus, ...) as well as HTTP server libraries (Apollo Server, Express, Mercurius, ...) are popular.

Also interested to learn what DBs and ORMs people are typically using to implement their GraphQL servers.

[benjie]

Here's a few more to get you started:

• how many people use persisted operations (aka persisted queries / stored operations)?
• how many people use GraphQL over GET?
• how many people use GraphQL as a client but not using the GraphQL-over-HTTP transport - what do they use? WS? SSE? (what else?)
• what is the mixture of GraphQL client usage on web versus mobile vs other?
• what are the most commonly used pieces of tooling?
• it seems that static operations have long become the best practice; is there still a significant portion of people constructing queries dynamically?
• what does usage of fragments look like? What proportion of people are using Relay-like per-component fragments, versus just some general fragments, versus fragments only for polymorphism?
• what does the response size of GraphQL requests look like? Are there many cases of multi-megabyte GraphQL responses? Gigabyte responses? 95% of GraphQL payloads are under [how many bytes]?
• what general (non-authn/authz) security protections do people have in place for GraphQL (rate limiting, malicious actor blocking, etc), and at what layer do they exist (firewall, HTTP request, validation, resolver, business logic)
• what's the prevalence of people versioning their GraphQL APIs

[SachaG]

what does the response size of GraphQL requests look like? Are there many cases of multi-megabyte GraphQL responses? Gigabyte responses? 95% of GraphQL payloads are under [how many bytes]?

Interesting, but I don't know if there's an easy way to find out things like that through a survey. Just FYI, generally it's always best if we can stick to questions that fit the multiple-choice format.

it seems that static operations have long become the best practice; is there still a significant portion of people constructing queries dynamically?

I don't know anybody who would do such a thing…

[charlypoly]

Hi @SachaG,

That's a great idea! 🚀

Here are the ideas/questions gathered with all The Guild members:

---

If you use GraphQL, which questions would you hope the survey would answer?

• Are you using GraphQL Subscription? if yes, with which transport? (SEE/WS)
• Which GraphQL language features are used?
  • Subscriptions
  • @live
  • @defer
  • @stream
  • Custom directives
  • Custom scalars
  • Schema extensions
  • Fragments
  • Union types
  • Interfaces
  • @deprecated
• Which of these techniques are you using for protecting your API from malicious actors?
  • Query Depth Limit
  • Query complexity
  • Persisted Operations
  • nothing
• How do people secure their APIs? (Do they even)
  • Auth tools? GraphQL Shield, AuthZ
  • Masking Server Errors
  • Depth Limit
  • Rate limit
  • Disable introspection
• What do people do to prevent breaking changes in the GraphQLSchema?
• How do you split your GraphQL schema?
  • Apollo Federation
  • GraphQL tools Stitching
  • GraphQL tools Merging
  • GraphQL Modules
• What execution-style do you use for your GraphQL Gateway?
  • Regular GraphQL Execution
  • Remote Execution
• If you are using remote execution, what kind of technology do you use?
  • Apollo Federation
  • Hasura
  • Schema Stitching
  • GraphQL Mesh
  • GraphCMS
• If you are using regular execution/server framework, what kind of technology do you use? / Which libraries are used to create servers?
  • Apollo Server
  • The new Yoga v2 (Transferred from Prisma to The Guild)
  • Yoga v1
  • Nest
  • GraphQL.js? (+ express)
  • Helix
  • Envelop+Helix
  • RedwoodJS
• What are you using GraphQL for?
  • complex front-end?
  • gateway?
  • orchestration?
  • product prototyping?
• Do people use SDL Codegen approaches or code-first approaches and in which language or framework?
• Do people 1:1 expose database as graphql (mesh style) or rather model the schema for frontend needs?
• Which GraphQL clients libs are used? (share of usage)
  • cf: https://graphql.org/code/
  • JavaScript
    • Apollo
    • URQL
    • React Query
    • Relay
    • GraphQL requests
  • iOS
    • Apollo iOS
    • SwiftGraphQL
  • Android
    • apollo-kotlin
• Which GraphQL server libs are used? (share of usage)
  • cf: https://graphql.org/code/
  • JavaScript
    • Apollo Server
    • The new Yoga v2 (Transferred from Prisma to The Guild)
    • Yoga v1
    • Nest
    • GraphQL.js? (+ express)
    • Helix
    • Envelop+Helix
    • RedwoodJS
  • Ruby
    • graphql-ruby
  • etc...
• Do people expose the GraphQL API to the public or behind a layer?
• Do people use GraphQL for public APIs or private APIs?
• How much of your application is powered by GraphQL?
  • Are people trying to use GraphQL for everything or only for new things? Are they planning to completely migrate everything to graphQL (and ditch other non-graphql APIs)?
• What tools do you use to collaborate on designing schemas for your GraphQL API?
• what are the company sizes of people adopting graphql and what expectations do companies of different sizes have of GraphQL
  • GraphQL monolith?
  • Distributed GraphQL?
• how do people delegate Graph ownership to teams/individuals
• do companies have separate GraphQL teams?

Which areas should it cover?

• GraphQL Language features
  • Which GraphQL language features are used?
  • Do you use Subscriptions?
• GraphQL usage
  • public (third part api users) or private (e.g. in-house application powering) API?
  • which use-case? front-end DX? orchestration? public API?
• GraphQL servers
• GraphQL clients
• GraphQL Gateways
• Tools/libraries
  • Are you using the following tools?
  • Which IDE do you use to work with GraphQL?
• SaaS
  • Which SaaS services are being used?
• Resources

Which features/architecture patterns/libraries/services should be included?

• Which SaaS services are being used?
  • Apollo studio
  • Hive
  • GraphCDN
  • Hasura Cloud
  • GraphCMS
  • Dgraph
  • AWS AppSync
  • OneGraph
  • Wundergraph
• Which IDE do you use to work with GraphQL?
  • cf: https://graphql.org/code/
  • GraphiQL
  • GraphQL Playground
  • Apollo Playground
  • GraphQL Explorer
  • Altair
  • Other?
• Are you using the following tools?
  • JavaScript
    • codegen
    • scalars
    • inspector
    • SOFA
    • GraphQL Config
    • GraphQL ESLint
    • Mesh
    • Postgraphile
    • Query builders
    • GraphQL Shield
    • AuthZ
    • Envelop
    • Apollo local state / Type Policies
    • GraphQL ESLint
  • TODO: other languages

What other questions can we ask to get a better picture of the GraphQL community?

• How far along are you in the GraphQL journey
• Are you using GraphQL in production?
• How many years are you using GraphQL?
• How many users your GraphQL API has in production?

What are the main current GraphQL pain points we should ask about?

• Do you feel GraphQL is a JavaScript technology?
• What do you use for performance tracing?
• What do you use to monitor your GraphQL APIs?

What are the main currently missing features we should ask about?

How do you stay up to date with GraphQL?

• What blogs do you follow for the latest GraphQL news?
  • https://graphql.org/blog/
  • https://www.apollographql.com/blog/
  • https://www.the-guild.dev/blog
  • https://www.graphqlweekly.com/
• Source for finding tools
  • https://graphql.org/code/
• Tutorials and Guides
  • https://graphql.org/
• What influencers do you follow that are working with GraphQL?
• Social Accounts
• YouTube channels
• How often do you check the specification RFPs?
• Do you watch the Working Group Recordings?
• Do you participate in the Working Group Meetings?
• Do you participate in the Working Group GitHub Discussions?

[SachaG]

@charlypoly oh wow thanks, that's an awesome list!

[eric-burel]

Awesome list indeed! My own questions mostly revolves around the point of view of an app developper:

• do people generate code from GraphQL, eg using graphql-codegen to generate some TypeScript?
• do people generate the GraphQL using some tools, eg relying on Hasura to manage the API instead of writing the graphql directly, or like we do at Vulcan based on a JavaScript schema
• how they synchronize their gql backend and the frontend: git submodules to share the types? using an API endpoint to download the schema etc.?
• what testing tool they use to mock requests during unit tests? Apollo Mock Provider, Cypress Dev Server, Mountebank, MSW

[praveenweb]

Hey all!

This is a great initiative and we already have an amazing list.

I'm listing down some more ideas based on conversations with the Hasura team.

• What use-cases are people thinking about: app vs data api
• Is GraphQL being for internal APIs or exposed as public-facing external APIs?
• Popular ways to write GraphQL servers? JavaScript/TypeScript vs Java vs .NET
• Are people using any form of caching with GraphQL?
• How are people thinking about OLTP vs OLAP use cases with GraphQL?

Additional inputs from @gavinray97

• Echoing the "What percentage of people use codegen tools?" question, If you use codegen, what kind of codegen do you use?
• Tools like graphql-code-generator that take pre-written queries and generate types for them or tools like graphql-zeus/genql that take a GraphQL server endpoint and generate a single SDK that dynamically infers types from query selections
• What sector/industry are you using GraphQL in? (What is the use case essentially?)
• Do you use Schema Stitching or Federation at all, to combine multiple graphs
• Is performance/latency a priority for you/your team?
  • If so, have you benchmarked/load-tested your GraphQL server?
  • Is your API entirely handwritten or does it also include tools that autogenerate resolvers, like graphql-mesh, Hasura, or Postgraphile?
• Are other teams in your organization using GraphQL?
• Are you/were you an early adopter inside of the organization?
  • If so, did it have a positive impact?

[jpvajda]

I'm really excited to see this come to fruition to the level that State of JS has delivered amazing data on the Javascript ecosystem!

[SachaG]

I've done some good progress on the outline and hope to be able to share a preview version of the survey soon! I did have a couple questions for you all:

• What are the differences between Yoga and Helix? Do they both belong in the "GraphQL Servers" category?
• Should we make a difference between Apollo Client React/iOS/Kotlin or group them all under "Apollo Client"?
• Should we ask about things like Next.js which will often consume GraphQL but are not related to GraphQL directly? If so under which category?
• Where would something like Gatsby fit in, since it both produces and consumes its own GraphQL API? What about Redwood?
• Should we ask about databases?

[benjie]

• Helix is kind of interesting because it's more of a server adaptor - it acts as the glue between a Node.js server (Express, Koa, Fastify, etc etc) and GraphQL (it also supports Deno and the browser). But yes, I'd include it in the servers category.
• Apollo clients for compiled languages have very significant differences (from what I understand) versus the client for web, so I'd keep them separate. Apollo client for React or any other web framework can probably be grouped :man_shrugging:
• :man_shrugging:
• :man_shrugging:
• :man_shrugging: (I personally would be interested to know what data sources people are using with their GraphQL APIs - filesystem (Gatsby), Postgres (PostGraphile, Hasura, etc), REST APIs, etc etc - but I don't know if that's of general interest or not.)

[jpvajda]

Hello! thanks for asking these questions! I'm the PM of Apollo Client so here is my personal take on these 😄

Should we make a difference between Apollo Client React/iOS/Kotlin or group them all under "Apollo Client"?

A: 💯 Yes. It be great to break these out as they serve different use cases and we actually have 3 different client teams working on these.

Should we ask about things like Next.js which will often consume GraphQL but are not related to GraphQL directly? If so under which category? I

A: Yes, At Apollo we are super curious on the use of these React frameworks and their growing popularity as it relates to GraphQL. I'd think you could group them under a category like Web Development Frameworks w/ GraphQL

Where would something like Gatsby fit in, since it both produces and consumes its own GraphQL API? What about Redwood?

A: See the answer above.

Should we ask about databases?

A: Yes! It be super interesting to know what databases are being used behind GraphQL across the industry.

---

Additional question I have that would be amazing to add into this survey are:

1. What Web Clients are people using with GraphQL? Some of the one's I keep an eye on are:

• @Apollo Client 3x (the newer version of our client)
• Apollo Client 2x (the older version of our client)
• AWS Amplify
• Relay
• URQL
• GraphQL Request
• Vue Apollo
• Svelte Apollo
• Apollo Angular

2. What mobile clients are people using with GraphQL for Android / iOS?

Some that I keep my eye on:

iOS

• Apollo iOS
• Graphaello
• Swift GraphQL

Android

• Apollo Kotlin
• DGS Framework
• GraphQL-Kotlin
• KGraphQL > now this fork KGraphQL

[SachaG]

OK, I have a preliminary outline ready! Thanks all for your patience: https://github.com/StateOfJS/Monorepo/issues/90