AIKIDO-2026-253365

TL;DR

The AshGraphql.Graphql.Resolver.query_complexity/3 function only multiplies child complexity for offset pagination that uses a limit argument. Relay connections and keyset pagination use first/last arguments, which fall through to a catch-all clause returning child_complexity + 1. Deeply nested relay queries therefore report trivial complexity scores while executing very large database reads, bypassing Absinthe complexity limits and enabling denial of service. The fix extends complexity calculation to first/last pagination arguments.