As someone who prefers PHP in general and find the TC39 committee has kneecapped the JS language in the past few years...

> PHP has a vastly simpler toolchain

Firmly disagree.

You can install Node and have a basic server running in a few seconds.

PHP requires installing and setting up a server tied into FPM and then reconfiguring a slurry of bad defaults. If you don't avoid the footgun of "traditional" deployments, you get to deal with mixed versions of source. If you don't avoid the footgun of "native" sessions, you get to deal with INCOMPLETE_CLASS errors galore.

And if you want a dynamic frontend, you're still going to want to bust out JS.

> I can't find any reason why I wouldn't use PHP instead

Using a single language for both frontend and backend with (largely) the same availability of tooling and the ability to share code (i.e. type definitions).

> generally better runtime performance

I find this hard to believe? Intuitively, I would assume that the Node / Bun engines are significantly faster than PHP - which doesn't even come with it's JIT enabled by default on the (perfectly valid) note that backends are almost always constrained by DB times.

> a package ecosystem with Composer that isn't overrun with inane vanity projects and supply-chain vulnerabilities.

Functionally, Composer is worse than any of the NPM package managers IMO. PHP's global, shared namespaces preventing monkey patching and nested dependencies is a huge burden when you need to use Lib A and Lib B, but both have conflicting dependencies on Lib C.

But the only reason it doesn't suffer (as many) supply chain issues is two-fold:

1. Packagist's source of truth is the repo and tags. It's much easier to notice a Github account being compromised, which is already harder because it's always had better account security expectations, than NPM. But this comes at costs - such as being unable to rename a package in-place, because Composer gets really confused when it clones a trunk that has a different name than what you asked for. And it's not intrinsically more secure, since tags are not immutable and people can host on less secure VCS platforms.

2. But more than that... it's just less used? The PHP ecosystem is noticeably smaller and has way less happening.

So its very much trade-offs.

PHP 8.6 Closure Optimizations