For now, there are three uses of commonprefix() in the stdlib:

1. In urllib.request it causes a security issue (see issue46756). commonpath() or just str.startswith() should be used instead.

2. In lib2to3.main. The code contains a workaround around commonprefix(). It could be simplified by using commonpath().

3. In unittest.util. This is the only correct use of commonprefix(). It cannot be replaced by commonpath().

I think that we should add commonprefix() in the string module (or maybe in a new module for operations on sequences), deprecate os.path.commonprefix() in documentation only, several versions later add a deprecation warning in os.path.commonprefix(), and several versions later remove os.path.commonprefix().