This might be of interest to anybody wondering why it could be unwise for URL to just adopt the WHATWG URL parser (and to the Foundation team, if they are indeed looking at parser changes): Fixing the Unfixable: Story of a Google Cloud SSRF.
Today, Foundation will refuse to parse this URL: "http://creds\\@host.com". The back-slash is part of the "unwise" character set in RFC-2396 and so must be percent-encoded. However, RFC-3986 doesn't require back-slashes to be percent-encoded. The WHATWG model goes even further, and considers back-slashes and forward-slashes to be equivalent in certain schemes, so the URL is interpreted as "http://creds/@host.com" (note: the host is "creds").
What happened in this bug is that when the allow-list checker parsed the URL string, it saw the host as "host.com" (as per 3986), which was allowed, but ended up sending a request (using the WHATWG model) to an attacker-controlled domain and leaked authorisation tokens which were used to compromise Google's own cloud account.
URLs are a bit of a nightmare, as you can see - 3 different standards, 3 different parsing behaviours, and mixing them in the same program or even across systems which share data or communicate with each other can lead to (potentially severe) misunderstandings. You may even be mixing standards right now without even realising it (in fact, it's quite likely). The WHATWG parsing behaviour is not necessarily better, but it's the model which incorporates all the weird compatibility behaviour actors on the web platform need to avoid those misunderstandings.
So... adding the WHATWG parsing behaviour to the existing URL type would be pretty risky, IMO. It's quite reasonable to have them as separate types. Whilst it is often possible to convert between them, the process is quite delicate and even depends on ordering (e.g. String -> WHATWG -> 2396 may have a significantly different result to String -> 2396 -> WHATWG). But even if we used the type-system to isolate the different standards in this way, and even if we had the most careful conversion routines possible, it still would not be enough; one subsystem (e.g. the allow-list checker) might be using one standard, and another subsystem (e.g. the request engine) might use a different standard. At least if they use different types, there's more of a signal that they might behave slightly differently.
Long-term, we're going to need a single standard throughout programs and across systems, and other systems will be using the WHATWG standard (because the web), so it is inevitable that we will need to, as well. There are lots of options for how that could be achieved with Foundation, but just changing URL's parser is probably not the best way.
But yeah - I thought this would of interest to people in this discussion.