I am trying to adopt feature toggle with Togglz for my Spring Boot 3.2.5 application. Unfortunately after I do the setup, at start-up, it says that I need a UserProvider.
Is this correct? Why would it need one if I specify the console to not be protected.
Also, how to remove the vulnerability CVE-2023-2976?

pom.xml

<!-- feature toggling -->
    <dependency>
      <groupId>org.togglz</groupId>
      <artifactId>togglz-spring-boot-starter</artifactId>
      <version>4.4.0</version>
    </dependency>
    <dependency>
      <groupId>org.togglz</groupId>
      <artifactId>togglz-console</artifactId>
      <version>4.4.0</version>
    </dependency>

application.yml

togglz:
  enabled: true
  features:
    FOO:
      enabled: true
    BAR:
      enabled: false
  console:
    enabled: true
    path: /togglz-console
    secured: false
    use-management-port: false

error at start-up

Parameter 2 of method featureManager in org.togglz.spring.boot.actuate.autoconfigure.TogglzAutoConfiguration$FeatureManagerConfiguration required a bean of type 'org.togglz.core.user.UserProvider' that could not be found.