Validate the hour, minute, second and offset ranges of the time format

CHANGELOG.txt

@@ -6,6 +6,7 @@
 * Added type annotations for public API and `py.typed` marker (PEP 561)
 * Added `message` to `JsonSchemaValuesException` joining messages of all collected errors
 * Fixed the `date-time` format accepting months, days and hours out of range (such as `2020-19-39T29:00:00Z`) and rejecting a leap second (`23:59:60Z`)
+* Fixed the `time` format accepting hours, minutes, seconds and offsets out of range (such as `29:99:99`)
 
 === 2.22.2 (2026-08-15)
 

fastjsonschema/draft07.py

@@ -13,9 +13,9 @@ class CodeGeneratorDraft07(CodeGeneratorDraft06):
         'relative-json-pointer': r'^(?:0|[1-9][0-9]*)(?:#|(?:\/(?:[^~/]|~0|~1)*)*)\Z',
         #'regex': r'',
         'time': (
-            r'^(?P<hour>\d{1,2}):(?P<minute>\d{1,2})'
-            r'(?::(?P<second>\d{1,2})(?:\.(?P<microsecond>\d{1,6}))?'
-            r'([zZ]|[+-]\d\d:\d\d)?)?\Z'
+            r'^(?P<hour>[01]?\d|2[0-3]):(?P<minute>[0-5]?\d)'
+            r'(?::(?P<second>[0-5]?\d|60)(?:\.(?P<microsecond>\d{1,6}))?'
+            r'([zZ]|[+-](?:[01]\d|2[0-3]):[0-5]\d)?)?\Z'
         ),
     })
 

tests/test_format.py

@@ -50,6 +50,30 @@ def test_hostname(asserter, value, expected):
     asserter({'type': 'string', 'format': 'hostname'}, value, expected)
 
 
+exc = JsonSchemaValueException('data must be time', value='{data}', name='data', definition='{definition}', rule='format')
+@pytest.mark.parametrize('value, expected', [
+    ('', exc),
+    ('bla', exc),
+    ('12:00:00', '12:00:00'),
+    ('12:00:00Z', '12:00:00Z'),
+    ('00:00:00.5+01:30', '00:00:00.5+01:30'),
+    ('23:59:59-23:59', '23:59:59-23:59'),
+    ('23:59:60Z', '23:59:60Z'),
+    ('24:00:00Z', exc),
+    ('29:00:00Z', exc),
+    ('99:99:99', exc),
+    ('12:60:00Z', exc),
+    ('12:00:61Z', exc),
+    ('12:00:00+24:00', exc),
+    ('12:00:00+00:60', exc),
+])
+def test_time(asserter, value, expected):
+    asserter({
+        '$schema': 'http://json-schema.org/draft-07/schema',
+        'format': 'time',
+    }, value, expected)
+
+
 exc = JsonSchemaValueException('data must be date', value='{data}', name='data', definition='{definition}', rule='format')
 @pytest.mark.parametrize('value, expected', [
     ('', exc),