Python's str.lower() can quietly break IDNA, opening a security hole
The C library you write against and the spec you think you're implementing are not always the same thing. Python's StringPrep path calls str.lower(), which folds characters using whatever Unicode version the interpreter ships, not the Unicode 3.2.0 rules RFC 3454 actually requires. That mismatch changes how certain domain names encode, and attackers can exploit it for IDN spoofing. The fix deep-links the correct per-codepoint exceptions instead of trusting the runtime default.