Mustang 2.3.3 was released on Tuesday, December 21st 2021 and updated it’s logback library from version 1.2.3 to 1.2.9.
Version 2021-12-13 and 2021-12-20 of https://github.com/mergebase/log4j-detector did not issue any warning so far but Github’s Dependabot recommended a version > 1.2.7 in conjunction with Log4j.