diff --git a/.travis.sh b/.travis.sh
index 44fcf604..3da8d6a8 100755
--- a/.travis.sh
+++ b/.travis.sh
@@ -34,6 +34,7 @@ if [[ ${TRAVIS_OS_NAME} = osx ]]; then
     latest_brew_python3_bin="$(ls -1d /usr/local/Cellar/python/3.*/bin | sort -n | tail -n1)"
     export PATH="${latest_brew_python3_bin}${PATH:+:}${PATH}"
     export PATH="/usr/local/opt/coreutils/libexec/gnubin${PATH:+:}${PATH}"
+    export PATH="/usr/local/opt/findutils/libexec/gnubin${PATH:+:}${PATH}"
 elif [[ ${TRAVIS_OS_NAME} = linux ]]; then
     export PATH="/usr/lib/llvm-9/bin:${PATH}"
 fi
@@ -59,7 +60,19 @@ elif [[ ${MODE} = cmake-oos ]]; then
     make DESTDIR="${PWD}"/ROOT install
     find ROOT -printf "%P\n" | sort
 elif [[ ${MODE} = cppcheck ]]; then
-    cppcheck --quiet --error-exitcode=1 .
+    cppcheck --version
+    find_args=(
+        -type f \(
+            -name \*.cpp
+            -o -name \*.c
+        \)
+        -not \(  # Exclude .c files that are merely included by other files
+            -name xmltok_ns.c
+            -o -name xmltok_impl.c
+        \)
+        -exec cppcheck --quiet --error-exitcode=1 --force {} +
+    )
+    find "${find_args[@]}"
 elif [[ ${MODE} = clang-format ]]; then
     ./apply-clang-format.sh
     git diff --exit-code
diff --git a/.travis.yml b/.travis.yml
index 39ea3025..2b0802ee 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,12 +15,13 @@ env:
     - CFLAGS='-g3 -pipe'
   matrix:
     - MODE=cmake-oos
-    - MODE=cppcheck
     - MODE=distcheck
     - MODE=qa-sh CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address
 
 matrix:
   include:
+    - os: osx
+      env: MODE=cppcheck
     - os: linux
       env: MODE=clang-format
     - os: linux
diff --git a/Brewfile b/Brewfile
index 98a87fd7..c2edcc1f 100644
--- a/Brewfile
+++ b/Brewfile
@@ -5,6 +5,7 @@ brew "coreutils"
 brew "cppcheck"
 brew "docbook2x"
 brew "dos2unix"
+brew "findutils"
 brew "gcc"
 brew "gettext"
 brew "ghostscript"
diff --git a/expat/Changes b/expat/Changes
index f76046d5..2a64a848 100644
--- a/expat/Changes
+++ b/expat/Changes
@@ -6,6 +6,7 @@ Release x.x.x xxx xxxxxxxxx xx xxxx
         Bug fixes:
   #390 #395 #398  Fix undefined behavior during parsing caused by
                     pointer arithmetic with NULL pointers
+            #404  Fix reading uninitialized variable during parsing
 
         Other changes:
             #396  Windows: Drop support for Visual Studio <=8.0/2005
@@ -41,6 +42,8 @@ Release x.x.x xxx xxxxxxxxx xx xxxx
             Maciej Sroczyński
             Mohammed Khajapasha
             Vadim Zeitlin
+                 and
+            Cppcheck 2.0 and the Cppcheck team
 
 Release 2.2.9 Wed September 25 2019
         Other changes:
diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
index 849411ce..492ae5e1 100644
--- a/expat/lib/xmlparse.c
+++ b/expat/lib/xmlparse.c
@@ -3592,7 +3592,7 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr,
   *startPtr = NULL;
 
   for (;;) {
-    const char *next;
+    const char *next = s; /* in case of XML_TOK_NONE or XML_TOK_PARTIAL */
     int tok = XmlCdataSectionTok(enc, s, end, &next);
     *eventEndPP = next;
     switch (tok) {
@@ -3710,7 +3710,7 @@ ignoreSectionProcessor(XML_Parser parser, const char *start, const char *end,
 static enum XML_Error
 doIgnoreSection(XML_Parser parser, const ENCODING *enc, const char **startPtr,
                 const char *end, const char **nextPtr, XML_Bool haveMore) {
-  const char *next;
+  const char *next = *startPtr; /* in case of XML_TOK_NONE or XML_TOK_PARTIAL */
   int tok;
   const char *s = *startPtr;
   const char **eventPP;