Bug #58637 describes and fixes IODKU unsafety. That patch needs cherry-picking.
INSERT ON DUPLICATE KEY UPDATE produces error 1032 (Can't find record)
Unexpected ER_KEY_NOT_FOUND upon REPLACE into table with foreign key with statement binary logging
Allow statement-based replication for REPLACE and INSERT…ON DUPLICATE KEY UPDATE
INSERT ON DUPLICATE KEY UPDATE foreign key fail
Merge new release of InnoDB 5.7.26 to 10.2