[GHSA-9x9x-v3ff-pj74] Add strix-agent PyPI package mapping - #9195

Summary

Add the missing PyPI package mapping for GHSA-9x9x-v3ff-pj74 / CVE-2026-15519.

The advisory currently has an empty affected array, so consumers cannot associate it with the published Python package.

Change

Map the advisory to:

• Ecosystem: PyPI
• Package: strix-agent

The affected project identified by the advisory is usestrix/strix, which is distributed on PyPI as strix-agent.

Version information

This change intentionally does not infer a patched version.

Although the advisory describes affected Strix releases up to 1.0.2, the existence of later releases by itself is not sufficient evidence that one of those releases contains the security fix. No fixed-version boundary is added without explicit upstream evidence.

References

• GHSA-9x9x-v3ff-pj74
• https://nvd.nist.gov/vuln/detail/CVE-2026-15519
• https://github.com/usestrix/strix
• https://pypi.org/project/strix-agent/
• https://github.com/ez-lbz/strix-vul-report

Validation

• JSON syntax validated
• git diff --check passes
• Only one advisory JSON file is changed