fix: Use module name over relative paths in go.mod replace directives

syft/pkg/cataloger/golang/parse_go_mod.go

@@ -77,18 +77,25 @@ func (c *goModCataloger) parseGoModFile(ctx context.Context, resolver file.Resol
 
 		// the old path and new path may be the same, in which case this is a noop,
 		// but if they're different we need to remove the old package.
-		delete(packages, m.Old.Path)
-
-		packages[m.New.Path] = pkg.Package{
-			Name:      m.New.Path,
+		// note that we may change the path but we should always reference the new version (since the old version
+		// cannot be trusted as a correct value).
+		var finalPath string
+		if !strings.HasPrefix(m.New.Path, ".") && !strings.HasPrefix(m.New.Path, "/") {
+			finalPath = m.New.Path
+			delete(packages, m.Old.Path)
+		} else {
+			finalPath = m.Old.Path
+		}
+		packages[finalPath] = pkg.Package{
+			Name:      finalPath,
 			Version:   m.New.Version,
 			Licenses:  pkg.NewLicenseSet(lics...),
 			Locations: file.NewLocationSet(reader.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
-			PURL:      packageURL(m.New.Path, m.New.Version),
+			PURL:      packageURL(finalPath, m.New.Version),
 			Language:  pkg.Go,
 			Type:      pkg.GoModulePkg,
 			Metadata: pkg.GolangModuleEntry{
-				H1Digest: digests[fmt.Sprintf("%s %s", m.New.Path, m.New.Version)],
+				H1Digest: digests[fmt.Sprintf("%s %s", finalPath, m.New.Version)],
 			},
 		}
 	}

syft/pkg/cataloger/golang/parse_go_mod_test.go

@@ -28,6 +28,20 @@ func TestParseGoMod(t *testing.T) {
 				},
 			},
 		},
+		{
+			fixture: "test-fixtures/relative-replace",
+			expected: []pkg.Package{
+				{
+					Name:      "github.com/aws/aws-sdk-go-v2",
+					Version:   "",
+					PURL:      "pkg:golang/github.com/aws/aws-sdk-go-v2",
+					Locations: file.NewLocationSet(file.NewLocation("test-fixtures/relative-replace")),
+					Language:  pkg.Go,
+					Type:      pkg.GoModulePkg,
+					Metadata:  pkg.GolangModuleEntry{},
+				},
+			},
+		},
 		{
 
 			fixture: "test-fixtures/many-packages",

syft/pkg/cataloger/golang/test-fixtures/relative-replace

@@ -0,0 +1,7 @@
+module github.com/aws/aws-sdk-go-v2/feature/ec2/imds
+
+go 1.22
+
+require github.com/aws/aws-sdk-go-v2 v1.36.3
+
+replace github.com/aws/aws-sdk-go-v2 => ../../../