diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 85bd06c5f3..50554acceb 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -56,6 +56,10 @@ repos:
         language: system
         types: [python]
         exclude: '^(pyextra/)|(cereal/)|(rednose/)|(panda/)|(laika/)|(laika_repo/)|(rednose_repo/)'
+        args:
+        - -rn
+        - -sn
+        - --rcfile=.pylintrc
 -   repo: local
     hooks:
     -   id: cppcheck
diff --git a/Pipfile b/Pipfile
index 17ef203672..3dba2755ab 100644
--- a/Pipfile
+++ b/Pipfile
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:622d406fc947cb3368849635f1da29fbeb002110bf1f9792022bffedf5cdff6d
-size 1607
+oid sha256:5fea746328dc90e4e1542a334508feda0616b2d19d7904f33a3ecfff2b1a6f79
+size 1621
diff --git a/Pipfile.lock b/Pipfile.lock
index 7cf3b9a9ad..928af97ea9 100644
--- a/Pipfile.lock
+++ b/Pipfile.lock
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:4e1dc8f78c5fcb90106aa180adb1091ff14c442d177bfa1ad2b5714b162b707e
-size 176374
+oid sha256:7d093d32dfcaf18972f9c62a0b87dc470ee0d74304ca8d659fc142ee0176b7c5
+size 188750
diff --git a/selfdrive/athena/tests/helpers.py b/selfdrive/athena/tests/helpers.py
index bb5fcd1063..071393cb14 100644
--- a/selfdrive/athena/tests/helpers.py
+++ b/selfdrive/athena/tests/helpers.py
@@ -116,7 +116,7 @@ def with_http_server(func):
     with Timeout(2, 'HTTP Server seeding failed'):
       while True:
         try:
-          requests.put(f'http://{host}:{port}/qlog.bz2', data='')
+          requests.put(f'http://{host}:{port}/qlog.bz2', data='', timeout=10)
           break
         except requests.exceptions.ConnectionError:
           time.sleep(0.1)
diff --git a/selfdrive/navd/navd.py b/selfdrive/navd/navd.py
index ee54252079..72874b2113 100755
--- a/selfdrive/navd/navd.py
+++ b/selfdrive/navd/navd.py
@@ -135,7 +135,7 @@ class RouteEngine:
 
     url = self.mapbox_host + f'/directions/v5/mapbox/driving-traffic/{self.last_position.longitude},{self.last_position.latitude};{destination.longitude},{destination.latitude}'
     try:
-      resp = requests.get(url, params=params)
+      resp = requests.get(url, params=params, timeout=10)
       resp.raise_for_status()
 
       r = resp.json()
diff --git a/selfdrive/ui/translations/create_badges.py b/selfdrive/ui/translations/create_badges.py
index 451fbb23eb..32904f242a 100755
--- a/selfdrive/ui/translations/create_badges.py
+++ b/selfdrive/ui/translations/create_badges.py
@@ -30,7 +30,7 @@ if __name__ == "__main__":
     percent_finished = int(100 - (unfinished_translations / total_translations * 100.))
     color = "green" if percent_finished == 100 else "orange" if percent_finished >= 70 else "red"
 
-    r = requests.get(f"https://img.shields.io/badge/LANGUAGE {name}-{percent_finished}%25 complete-{color}")
+    r = requests.get(f"https://img.shields.io/badge/LANGUAGE {name}-{percent_finished}%25 complete-{color}", timeout=10)
     assert r.status_code == 200, "Error downloading badge"
     content_svg = r.content.decode("utf-8")
 
diff --git a/system/hardware/tici/agnos.py b/system/hardware/tici/agnos.py
index 9a1759e99f..51998bf8b7 100755
--- a/system/hardware/tici/agnos.py
+++ b/system/hardware/tici/agnos.py
@@ -20,7 +20,7 @@ class StreamingDecompressor:
   def __init__(self, url: str) -> None:
     self.buf = b""
 
-    self.req = requests.get(url, stream=True, headers={'Accept-Encoding': None})  # type: ignore
+    self.req = requests.get(url, stream=True, headers={'Accept-Encoding': None})  # type: ignore # pylint: disable=missing-timeout
     self.it = self.req.iter_content(chunk_size=1024 * 1024)
     self.decompressor = lzma.LZMADecompressor(format=lzma.FORMAT_AUTO)
     self.eof = False
diff --git a/system/hardware/tici/test_agnos_updater.py b/system/hardware/tici/test_agnos_updater.py
index 9f188b83dc..e0d6ed8814 100755
--- a/system/hardware/tici/test_agnos_updater.py
+++ b/system/hardware/tici/test_agnos_updater.py
@@ -15,7 +15,7 @@ class TestAgnosUpdater(unittest.TestCase):
       m = json.load(f)
 
     for img in m:
-      r = requests.head(img['url'])
+      r = requests.head(img['url'], timeout=10)
       r.raise_for_status()
       self.assertEqual(r.headers['Content-Type'], "application/x-xz")
       if not img['sparse']:
diff --git a/system/hardware/tici/tests/compare_casync_manifest.py b/system/hardware/tici/tests/compare_casync_manifest.py
index 5e5fa24556..b462e93ebc 100755
--- a/system/hardware/tici/tests/compare_casync_manifest.py
+++ b/system/hardware/tici/tests/compare_casync_manifest.py
@@ -17,7 +17,7 @@ def get_chunk_download_size(chunk):
   if os.path.isfile(path):
     return os.path.getsize(path)
   else:
-    r = requests.head(path)
+    r = requests.head(path, timeout=10)
     r.raise_for_status()
     return int(r.headers['content-length'])
 
diff --git a/tools/joystick/joystickd.py b/tools/joystick/joystickd.py
index 35ecca351d..8374cf8a74 100755
--- a/tools/joystick/joystickd.py
+++ b/tools/joystick/joystickd.py
@@ -77,7 +77,7 @@ def send_thread(joystick):
     print('\n' + ', '.join(f'{name}: {round(v, 3)}' for name, v in joystick.axes_values.items()))
     if "WEB" in os.environ:
       import requests
-      requests.get("http://"+os.environ["WEB"]+":5000/control/%f/%f" % tuple([joystick.axes_values[a] for a in joystick.axes_order][::-1]))
+      requests.get("http://"+os.environ["WEB"]+":5000/control/%f/%f" % tuple([joystick.axes_values[a] for a in joystick.axes_order][::-1]), timeout=None)
     rk.keep_time()
 
 def joystick_thread(use_keyboard):
diff --git a/tools/lib/tests/test_readers.py b/tools/lib/tests/test_readers.py
index c982459f92..6efa0dc351 100755
--- a/tools/lib/tests/test_readers.py
+++ b/tools/lib/tests/test_readers.py
@@ -21,7 +21,7 @@ class TestReaders(unittest.TestCase):
       self.assertEqual(hist['logMessage'], 6857)
 
     with tempfile.NamedTemporaryFile(suffix=".bz2") as fp:
-      r = requests.get("https://github.com/commaai/comma2k19/blob/master/Example_1/b0c9d2329ad1606b%7C2018-08-02--08-34-47/40/raw_log.bz2?raw=true")
+      r = requests.get("https://github.com/commaai/comma2k19/blob/master/Example_1/b0c9d2329ad1606b%7C2018-08-02--08-34-47/40/raw_log.bz2?raw=true", timeout=10)
       fp.write(r.content)
       fp.flush()
 
@@ -53,7 +53,7 @@ class TestReaders(unittest.TestCase):
       assert np.all(frame_first_30[15] == frame_15[0])
 
     with tempfile.NamedTemporaryFile(suffix=".hevc") as fp:
-      r = requests.get("https://github.com/commaai/comma2k19/blob/master/Example_1/b0c9d2329ad1606b%7C2018-08-02--08-34-47/40/video.hevc?raw=true")
+      r = requests.get("https://github.com/commaai/comma2k19/blob/master/Example_1/b0c9d2329ad1606b%7C2018-08-02--08-34-47/40/video.hevc?raw=true", timeout=10)
       fp.write(r.content)
       fp.flush()
 
diff --git a/tools/plotjuggler/juggle.py b/tools/plotjuggler/juggle.py
index e3d0aec59b..b7c32d9bf1 100755
--- a/tools/plotjuggler/juggle.py
+++ b/tools/plotjuggler/juggle.py
@@ -37,7 +37,7 @@ def install():
   os.mkdir(INSTALL_DIR)
 
   url = os.path.join(RELEASES_URL, m + ".tar.gz")
-  with requests.get(url, stream=True) as r, tempfile.NamedTemporaryFile() as tmp:
+  with requests.get(url, stream=True, timeout=10) as r, tempfile.NamedTemporaryFile() as tmp:
     r.raise_for_status()
     with open(tmp.name, 'wb') as tmpf:
       for chunk in r.iter_content(chunk_size=1024*1024):
diff --git a/tools/scripts/fetch_image_from_route.py b/tools/scripts/fetch_image_from_route.py
index 39751ba551..139373f665 100755
--- a/tools/scripts/fetch_image_from_route.py
+++ b/tools/scripts/fetch_image_from_route.py
@@ -18,7 +18,7 @@ segment = int(sys.argv[2])
 frame = int(sys.argv[3])
 
 url = 'https://api.commadotai.com/v1/route/'+sys.argv[1]+"/files"
-r = requests.get(url, headers={"Authorization": "JWT "+jwt})
+r = requests.get(url, headers={"Authorization": "JWT "+jwt}, timeout=10)
 assert r.status_code == 200
 print("got api response")
 
diff --git a/tools/scripts/setup_ssh_keys.py b/tools/scripts/setup_ssh_keys.py
index 5b5ebfbac5..b6d4486733 100755
--- a/tools/scripts/setup_ssh_keys.py
+++ b/tools/scripts/setup_ssh_keys.py
@@ -11,7 +11,7 @@ if __name__ == "__main__":
     exit(1)
 
   username = sys.argv[1]
-  keys = requests.get(f"https://github.com/{username}.keys")
+  keys = requests.get(f"https://github.com/{username}.keys", timeout=10)
 
   if keys.status_code == 200:
     Params().put("GithubSshKeys", keys.text)
diff --git a/update_requirements.sh b/update_requirements.sh
index 719a28c359..060dca76ef 100755
--- a/update_requirements.sh
+++ b/update_requirements.sh
@@ -44,6 +44,7 @@ pip install pip==21.3.1
 pip install pipenv==2021.11.23
 
 if [ -d "./xx" ]; then
+  echo "WARNING: using xx Pipfile ******"
   export PIPENV_SYSTEM=1
   export PIPENV_PIPFILE=./xx/Pipfile
 fi
@@ -56,7 +57,8 @@ else
 fi
 
 echo "pip packages install..."
-pipenv install --dev --deploy --clear
+pipenv sync --dev
+pipenv --clear
 pyenv rehash
 
 echo "pre-commit hooks install..."